Paloaltonetworks PAN-OS vulnerabilities

209 known vulnerabilities affecting paloaltonetworks/pan-os.

Total CVEs
209
CISA KEV
12
actively exploited
Public exploits
14
Exploited in wild
9
Severity breakdown
CRITICAL33HIGH75MEDIUM93LOW8

Vulnerabilities

Page 8 of 11
CVE-2019-1575HIGHCVSS 8.8fixed in 7.1.24≥ 8.0.0, < 8.0.19+3 more2019-07-16
CVE-2019-1575 [HIGH] CWE-200 CVE-2019-1575: Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them.
nvd
CVE-2019-1576HIGHCVSS 8.8≥ 9.0.0, ≤ 9.0.22019-07-16
CVE-2019-1576 [HIGH] CWE-78 CVE-2019-1576: Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user’s permissions.
nvd
CVE-2019-1572HIGHCVSS 7.5v9.0.02019-03-26
CVE-2019-1572 [HIGH] CVE-2019-1572: PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files. PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
nvd
CVE-2019-1559MEDIUMCVSS 5.9≥ 7.1.0, < 7.1.15≥ 8.0.0, < 8.0.20+2 more2019-02-27
CVE-2019-1559 [MEDIUM] CWE-203 CVE-2019-1559: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to sen If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behave
nvd
CVE-2019-1566MEDIUMCVSS 6.1≥ 7.1.0, < 7.1.22≥ 8.0.0, < 8.0.15+1 more2019-01-30
CVE-2019-1566 [MEDIUM] CWE-79 CVE-2019-1566: The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
nvd
CVE-2019-1565MEDIUMCVSS 5.4≤ 7.1.21≥ 7.1.22, ≤ 8.0.14+1 more2019-01-30
CVE-2019-1565 [MEDIUM] CWE-79 CVE-2019-1565: The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN- The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.
nvd
CVE-2018-10141MEDIUMCVSS 6.1PoCfixed in 6.1.0≥ 7.0.0, ≤ 7.0.19+1 more2018-10-12
CVE-2018-10141 [MEDIUM] CWE-79 CVE-2018-10141: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.
nvd
CVE-2018-18065MEDIUMCVSS 6.5PoC≤ 7.1.22≥ 7.1.23, ≤ 8.0.15+1 more2018-10-08
CVE-2018-18065 [MEDIUM] CWE-476 CVE-2018-18065: _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
nvd
CVE-2018-14634HIGHCVSS 7.8KEVPoC≥ 7.1.0, < 7.1.23≥ 8.0.0, < 8.0.16+1 more2018-09-25
CVE-2018-14634 [HIGH] CWE-190 CVE-2018-14634: An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileg An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
nvd
CVE-2018-10139MEDIUMCVSS 6.1≤ 6.1.21≥ 7.1.0, ≤ 7.1.18+1 more2018-08-16
CVE-2018-10139 [MEDIUM] CWE-79 CVE-2018-10139: The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-O The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
nvd
CVE-2018-10140MEDIUMCVSS 4.3≥ 8.1.0, ≤ 8.1.22018-08-16
CVE-2018-10140 [MEDIUM] CWE-20 CVE-2018-10140: The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an auth The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
nvd
CVE-2018-7636MEDIUMCVSS 6.1v8.0.102018-07-03
CVE-2018-7636 [MEDIUM] CWE-79 CVE-2018-7636: The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to injec The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs.
nvd
CVE-2018-9334MEDIUMCVSS 5.5≤ 6.1.20≥ 7.1.0, ≤ 7.1.16+2 more2018-07-03
CVE-2018-9334 [MEDIUM] CWE-269 CVE-2018-9334: The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PA The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup.
nvd
CVE-2018-9337MEDIUMCVSS 5.4≤ 6.1.20≥ 7.1.0, ≤ 7.1.17+2 more2018-07-03
CVE-2018-9337 [MEDIUM] CWE-79 CVE-2018-9337: The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.
nvd
CVE-2018-9242MEDIUMCVSS 5.5≤ 6.1.20≥ 7.1.0, ≤ 7.1.16+1 more2018-07-03
CVE-2018-9242 [MEDIUM] CWE-20 CVE-2018-9242: The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PA The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.
nvd
CVE-2018-9335MEDIUMCVSS 5.4≤ 6.1.20≥ 7.1.0, ≤ 7.1.16+2 more2018-07-03
CVE-2018-9335 [MEDIUM] CWE-79 CVE-2018-9335: The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.
nvd
CVE-2017-17841MEDIUMCVSS 5.9v6.1.0v7.1.0+22 more2018-01-10
CVE-2017-17841 [MEDIUM] CVE-2017-17841: Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decrypt Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
nvd
CVE-2017-15941MEDIUMCVSS 6.1fixed in 6.1.19≥ 7.0.0, < 7.0.19+2 more2018-01-10
CVE-2017-15941 [MEDIUM] CWE-79 CVE-2017-15941: Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7. Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2017-16878MEDIUMCVSS 6.1fixed in 8.0.72018-01-10
CVE-2017-16878 [MEDIUM] CWE-79 CVE-2017-16878: Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by leveraging an unspecified configuration.
nvd
CVE-2017-15944CRITICALCVSS 9.8KEVPoCfixed in 6.1.19≥ 7.0.0, < 7.0.19+2 more2017-12-11
CVE-2017-15944 [CRITICAL] CWE-20 CVE-2017-15944: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
nvd
← Previous8 / 11Next →