PRIOn Logo

Search KB


Search our pre-analyzed vulnerability database

Total Results: 235

of 12

Published:   Updated:

Vulnerability Type: Command injection

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.7

An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

Published:   Updated:

Vulnerability Type: Design/Logic Flaw

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.7

An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

Published:   Updated:

Vulnerability Type: Privilege escalation

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v32.7

An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.

Published:   Updated:

Vulnerability Type: Command injection

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v36.3

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

Published:   Updated:

Vulnerability Type: Cross site scripting

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.9

A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.

Published:   Updated:

Vulnerability Type: Cross site scripting

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v36.1

A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.

Published:   Updated:

Vulnerability Type: Cross site scripting

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.8

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.

Published:   Updated:

Vulnerability Type: Privilege escalation

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v36.7

A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine.

Published:   Updated:

Vulnerability Type: Code injection

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v35.5

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.

Published:   Updated:

Vulnerability Type: Code injection

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.9

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

Published:   Updated:

Vulnerability Type: Cross site scripting

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v35.4

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

Published:   Updated:

Vulnerability Type: Privilege escalation

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v37.8

A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.

Published:   Updated:

Vulnerability Type: Race condition

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.4

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

Published:   Updated:

Vulnerability Type: Cross site scripting

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.8

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.

Published:   Updated:

Vulnerability Type: Race condition

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v36.3

A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.

Published:   Updated:

Vulnerability Type: Design/Logic Flaw

Vendor(s):  Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v34.9

A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.

Published:   Updated:

Vulnerability Type: Arbitrary file deletion

Vendor(s):  Fedoraproject, Paloaltonetworks
Significant
Remediate Within one Month
CVSS v2N/ACVSS v36.5

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software.

Published:   Updated:

Vulnerability Type: Arbitrary file deletion

Vendor(s):  Fedoraproject, Paloaltonetworks
Routine
Remediate Within 6 Months
CVSS v2N/ACVSS v36.5

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Published:   Updated:

Vulnerability Type: Command injection

Vendor(s):  Paloaltonetworks
Significant
Remediate Within one Month
CVSS v2N/ACVSS v37.8

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

Published:   Updated:

Vulnerability Type: Information disclosure

Vendor(s):  Paloaltonetworks
Urgent
Remediate Within one Week
CVSS v2N/ACVSS v36.7

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.

of 12