Paloaltonetworks PAN-OS vulnerabilities

CVE-2024-5918 [MEDIUM] CWE-295 CVE-2024-5918: An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an au An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client C

CVE-2023-0010 [MEDIUM] CWE-79 CVE-2023-0010: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Netw A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

CVE-2020-1995 [MEDIUM] CWE-476 CVE-2020-1995: A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated admini A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 ver

CVE-2017-7217 [MEDIUM] CWE-20 CVE-2017-7217: The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allow The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export files via unspecified parameters.

CVE-2024-8688 [MEDIUM] CWE-155 CVE-2024-8688: An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS comman An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewall.

CVE-2017-5584 [MEDIUM] CWE-79 CVE-2017-5584: Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-O Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2016-2219 [MEDIUM] CWE-79 CVE-2016-2219: Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7. Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2013-5664 [MEDIUM] CWE-79 CVE-2013-5664: Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.

CVE-2020-1982 [MEDIUM] CWE-326 CVE-2020-1982: Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which i Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the comm

CVE-2018-10140 [MEDIUM] CWE-20 CVE-2018-10140: The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an auth The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.

CVE-2026-0256 [MEDIUM] CWE-79 CVE-2026-0256: A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a m A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not

CVE-2026-0266 [MEDIUM] CWE-79 CVE-2026-0266: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a maliciou A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected

CVE-2022-0022 [MEDIUM] CWE-916 CVE-2022-0022: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password has Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account pa

CVE-2012-6596 [MEDIUM] CWE-255 CVE-2012-6596: Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passw Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passwords in authd.log, which allows context-dependent attackers to obtain sensitive information by reading this file, aka Ref ID 35493.

CVE-2012-6590 [MEDIUM] CWE-200 CVE-2012-6590: The web-based management UI in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote attackers The web-based management UI in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote attackers to obtain verbose error information via crafted input, aka Ref ID 33139.

CVE-2024-5920 [MEDIUM] CWE-79 CVE-2024-5920: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenti A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in

CVE-2014-3764 [MEDIUM] CWE-79 CVE-2014-3764: Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto N Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS before 5.0.15, 5.1.x before 5.1.10, and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Ref ID 64563.

CVE-2023-0008 [MEDIUM] CWE-73 CVE-2023-0008: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read- A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

CVE-2021-3036 [MEDIUM] CWE-532 CVE-2021-3036: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client inc

CVE-2020-1994 [MEDIUM] CWE-377 CVE-2020-1994: A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell ac A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7.