pan-os Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/pan-os/ Sun, 26 Feb 2023 06:38:52 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png pan-os Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/pan-os/ 32 32 CVE-2020-2038 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-2038/ Sun, 26 Feb 2023 06:38:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-2038/ An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

The post CVE-2020-2038 appeared first on CVE Vulnerability.

]]> An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

The post CVE-2020-2038 appeared first on CVE Vulnerability.

]]> CVE-2019-1566 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-1566/ Sun, 26 Feb 2023 06:31:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-1566/ The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.

The post CVE-2019-1566 appeared first on CVE Vulnerability.

]]> The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.

The post CVE-2019-1566 appeared first on CVE Vulnerability.

]]> CVE-2019-1559 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-1559/ Sun, 26 Feb 2023 06:30:59 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-1559/ If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. […]

The post CVE-2019-1559 appeared first on CVE Vulnerability.

]]> If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable “non-stitched” ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

The post CVE-2019-1559 appeared first on CVE Vulnerability.

]]> CVE-2021-3064 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3064/ Thu, 23 Feb 2023 14:09:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3064/ A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS […]

The post CVE-2021-3064 appeared first on CVE Vulnerability.

]]> A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.

The post CVE-2021-3064 appeared first on CVE Vulnerability.

]]> CVE-2021-3063 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3063/ Thu, 23 Feb 2023 14:09:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3063/ An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by […]

The post CVE-2021-3063 appeared first on CVE Vulnerability.

]]> An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.

The post CVE-2021-3063 appeared first on CVE Vulnerability.

]]> CVE-2021-3062 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3062/ Thu, 23 Feb 2023 14:09:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3062/ An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: […]

The post CVE-2021-3062 appeared first on CVE Vulnerability.

]]> An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

The post CVE-2021-3062 appeared first on CVE Vulnerability.

]]> CVE-2021-3059 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3059/ Thu, 23 Feb 2023 14:09:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3059/ An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS […]

The post CVE-2021-3059 appeared first on CVE Vulnerability.

]]> An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue.

The post CVE-2021-3059 appeared first on CVE Vulnerability.

]]> CVE-2021-3061 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3061/ Thu, 23 Feb 2023 14:09:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3061/ An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS […]

The post CVE-2021-3061 appeared first on CVE Vulnerability.

]]> An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 firewalls are impacted by this issue.

The post CVE-2021-3061 appeared first on CVE Vulnerability.

]]> CVE-2021-3060 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3060/ Thu, 23 Feb 2023 14:09:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3060/ An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 […]

The post CVE-2021-3060 appeared first on CVE Vulnerability.

]]> An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.

The post CVE-2021-3060 appeared first on CVE Vulnerability.

]]> CVE-2021-3058 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3058/ Thu, 23 Feb 2023 14:09:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3058/ An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than […]

The post CVE-2021-3058 appeared first on CVE Vulnerability.

]]> An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. This issue does not impact Prisma Access firewalls.

The post CVE-2021-3058 appeared first on CVE Vulnerability.

]]>