Advisories · Technology

Palo Alto Networks PAN-OS.

Every CVE that names Palo Alto Networks PAN-OS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-3062 CVE record

CVSS 8.1 High

PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Broken access control
Not analysed yet 10 Nov 2021
CVE-2021-3061 CVE record

CVSS 6.4 Medium

PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI)
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 10 Nov 2021
CVE-2021-3060 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 10 Nov 2021
CVE-2021-3059 CVE record

CVSS 8.1 High

PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 10 Nov 2021
CVE-2021-3058 CVE record

CVSS 8.8 High

PAN-OS: OS Command Injection Vulnerability in Web Interface XML API
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 10 Nov 2021
CVE-2021-3056 CVE record

CVSS 8.8 High

PAN-OS: Memory Corruption Vulnerability in GlobalProtect Clientless VPN During SAML Authentication
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Memory corruption
Not analysed yet 10 Nov 2021
CVE-2021-3055 CVE record

CVSS 6.5 Medium

PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
Not analysed yet 8 Sept 2021
CVE-2021-3054 CVE record

CVSS 7.2 High

PAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability
- Palo Alto Networks PAN-OS
- Race condition
Not analysed yet 8 Sept 2021
CVE-2021-3053 CVE record

CVSS 7.5 High

PAN-OS: Exceptional Condition Denial-of-Service (DoS)
- Palo Alto Networks PAN-OS
- CWE-755
Not analysed yet 8 Sept 2021
CVE-2021-3052 CVE record

CVSS 8.0 High

PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2021
CVE-2021-3050 CVE record

CVSS 8.8 High

PAN-OS: OS Command Injection Vulnerability in Web Interface
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 11 Aug 2021
CVE-2021-3048 CVE record

CVSS 5.9 Medium

PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage
- Palo Alto Networks PAN-OS
- CWE-20
Not analysed yet 11 Aug 2021
CVE-2021-3047 CVE record

CVSS 4.2 Medium

PAN-OS: Weak Cryptography Used in Web Interface Authentication
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 11 Aug 2021
CVE-2021-3046 CVE record

CVSS 6.8 Medium

PAN-OS: Improper SAML Authentication Vulnerability in GlobalProtect Portal
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 11 Aug 2021
CVE-2021-3045 CVE record

CVSS 4.9 Medium

PAN-OS: OS Command Argument Injection in Web Interface
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 11 Aug 2021
CVE-2021-3037 CVE record

CVSS 2.3 Low

PAN-OS: Secrets for scheduled configuration exports are logged in system logs
- Palo Alto Networks PAN-OS
- CWE-534
Not analysed yet 20 Apr 2021
CVE-2021-3036 CVE record

CVSS 4.4 Medium

PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 20 Apr 2021
CVE-2021-3032 CVE record

CVSS 4.4 Medium

PAN-OS: Configuration secrets for log forwarding may be logged in system logs
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 13 Jan 2021
CVE-2021-3031 CVE record

CVSS 4.3 Medium

PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 13 Jan 2021
CVE-2020-2050 CVE record

CVSS 8.2 High

PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification
- Palo Alto Networks PAN-OS
- Broken access control
Not analysed yet 12 Nov 2020
CVE-2020-2048 CVE record

CVSS 3.3 Low

PAN-OS: System proxy passwords may be logged in clear text while viewing system state
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 12 Nov 2020
CVE-2020-2022 CVE record

CVSS 7.5 High

PAN-OS: Panorama session disclosure during context switch into managed device
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 12 Nov 2020
CVE-2020-2000 CVE record

CVSS 7.2 High

PAN-OS: OS command injection and memory corruption vulnerability
- Palo Alto Networks PAN-OS
- Command injection
- Memory corruption
Not analysed yet 12 Nov 2020
CVE-2020-1999 CVE record

CVSS 5.3 Medium

PAN-OS: Threat signatures are evaded by specifically crafted packets
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 12 Nov 2020
CVE-2020-2044 CVE record

CVSS 3.3 Low

PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 9 Sept 2020
CVE-2020-2043 CVE record

CVSS 3.3 Low

PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 9 Sept 2020
CVE-2020-2042 CVE record

CVSS 7.2 High

PAN-OS: Buffer overflow in the management web interface
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 9 Sept 2020
CVE-2020-2041 CVE record

CVSS 7.5 High

PAN-OS: Management web interface denial-of-service (DoS)
- Palo Alto Networks PAN-OS
- CWE-16
Not analysed yet 9 Sept 2020
CVE-2020-2040 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 9 Sept 2020
CVE-2020-2039 CVE record

CVSS 5.3 Medium

PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload
- Palo Alto Networks PAN-OS
- Denial of service
Not analysed yet 9 Sept 2020
CVE-2020-2038 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

PAN-OS: OS command injection vulnerability in the management web interface
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 9 Sept 2020
CVE-2020-2037 CVE record

CVSS 7.2 High

PAN-OS: OS command injection vulnerability in the management web interface
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 9 Sept 2020
CVE-2020-2036 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2020
CVE-2020-2035 CVE record

CVSS 3.0 Low

PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions
- Palo Alto Networks PAN-OS
- CWE-20
Not analysed yet 12 Aug 2020
CVE-2020-2034 CVE record

CVSS 8.1 High

PAN-OS: OS command injection vulnerability in GlobalProtect portal
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 8 Jul 2020
CVE-2020-2031 CVE record

CVSS 4.9 Medium

PAN-OS: Integer underflow in the management interface
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 8 Jul 2020
CVE-2020-2030 CVE record

CVSS 7.2 High

PAN-OS: OS command injection vulnerability in the management interface
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 8 Jul 2020
CVE-2020-1982 CVE record

CVSS 4.8 Medium

PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 8 Jul 2020
CVE-2020-2021 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+KEV · ransomware

PAN-OS: Authentication Bypass in SAML Authentication
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 29 Jun 2020
CVE-2020-2029 CVE record

CVSS 7.2 High

PAN-OS: OS command injection vulnerability in management interface certificate generator
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 10 Jun 2020
CVE-2020-2028 CVE record

CVSS 7.2 High

PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 10 Jun 2020
CVE-2020-2027 CVE record

CVSS 7.2 High

PAN-OS: Buffer overflow in authd authentication response
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 10 Jun 2020
CVE-2020-2018 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

PAN-OS: Panorama authentication bypass vulnerability
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 13 May 2020
CVE-2020-2017 CVE record

CVSS 8.8 High

PAN-OS: DOM-Based cross site scripting vulnerability in management web interface
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 13 May 2020
CVE-2020-2016 CVE record

CVSS 7.0 High

PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation
- Palo Alto Networks PAN-OS
- CWE-377
Not analysed yet 13 May 2020
CVE-2020-2015 CVE record

CVSS 8.8 High

PAN-OS: Buffer overflow in the management server
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 13 May 2020
CVE-2020-2014 CVE record

CVSS 8.8 High

PAN-OS: OS injection vulnerability in PAN-OS management server
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 13 May 2020
CVE-2020-2013 CVE record

CVSS 8.3 High

PAN-OS: Panorama context switch session cookie disclosure
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 13 May 2020
CVE-2020-2012 CVE record

CVSS 7.5 High

PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
Not analysed yet 13 May 2020
CVE-2020-2011 CVE record

CVSS 7.5 High

PAN-OS: Panorama registration denial of service
- Palo Alto Networks PAN-OS
- CWE-20
Not analysed yet 13 May 2020
CVE-2020-2010 CVE record

CVSS 7.2 High

PAN-OS: Authenticated user command injection vulnerability
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 13 May 2020
CVE-2020-2009 CVE record

CVSS 7.2 High

PAN-OS: Panorama SD WAN arbitrary file creation
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 13 May 2020
CVE-2020-2008 CVE record

CVSS 7.2 High

PAN-OS: OS command injection or arbitrary file deletion vulnerability
- Palo Alto Networks PAN-OS
- Path traversal
- Command injection
Not analysed yet 13 May 2020
CVE-2020-2007 CVE record

CVSS 7.2 High

PAN-OS: OS command injection in management server
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 13 May 2020
CVE-2020-2006 CVE record

CVSS 7.2 High

PAN-OS: Buffer overflow in management server payload parser
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 13 May 2020
CVE-2020-2005 CVE record

CVSS 7.1 High

PAN-OS: GlobalProtect Clientless VPN session hijacking
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 13 May 2020
CVE-2020-2003 CVE record

CVSS 6.5 Medium

PAN-OS: Authenticated administrator can delete arbitrary system file
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 13 May 2020
CVE-2020-2002 CVE record

CVSS 8.1 High

PAN-OS: Spoofed Kerberos key distribution center authentication bypass
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 13 May 2020
CVE-2020-2001 CVE record

CVSS 8.1 High

PAN-OS: Panorama External control of file vulnerability leads to privilege escalation
- Palo Alto Networks PAN-OS
- CWE-123
Not analysed yet 13 May 2020
CVE-2020-1998 CVE record

CVSS 5.4 Medium

PAN-OS: Improper SAML SSO authorization of shared local users
- Palo Alto Networks PAN-OS
- Broken access control
Not analysed yet 13 May 2020