Palo Alto Networks paloaltonetworks pan-os any version

Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.

PAN-OS: Improper Neutralization of Input in the Management Web Interface

PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

PAN-OS: IPv6 Firewall Policy Bypass

PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)

PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

PAN-OS: GlobalProtect Clientless VPN session hijacking

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

PAN-OS: User Impersonation in GlobalProtect Portal

PAN-OS: Information Disclosure Vulnerability in Management Web Interface

PAN-OS: File Upload Vulnerability in the Panorama Web Interface

PAN-OS: Management server rasmgr denial of service

PAN-OS: Integer underflow in the management interface

PAN-OS: Improper SAML Authentication Vulnerability in GlobalProtect Portal

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

PAN-OS: Improper Input Validation Vulnerability in PAN-OS

PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.

_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string.

The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors.

The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified request parameters.

PAN-OS: Local File Deletion Vulnerability

The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541.

PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

PAN-OS: File Deletion Vulnerability in Management Web Interface

Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command, aka Ref ID 35254.

PAN-OS: OS Command Injection Vulnerability in the XML API

PAN-OS: Improper IP Address Verification in GlobalProtect Gateway

GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.

Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper request parameter validation.

Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.

Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by leveraging an unspecified configuration.