Palo Alto Networks paloaltonetworks pan-os any version

Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.

PAN-OS: GlobalProtect registration open redirect

PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

PAN-OS: Cleartext Exposure of External System Secrets

0-byte record padding oracle

PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage

PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure

PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services

PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing

PAN-OS: OS Command Injection Vulnerability in the Web Interface

PAN-OS: File Upload Vulnerability in the Web Interface

PAN-OS: Read System Files and Resources During Configuration Commit

PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup.

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities.

PAN-OS: Threat signatures are evaded by specifically crafted packets

PAN-OS: Panorama management server log injection

PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended

PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

PAN-OS: User Impersonation in GlobalProtect SSL VPN

PAN-OS: OS Command Argument Injection in Web Interface

PAN-OS: Plaintext Disclosure of External System Integration Credentials

PAN-OS: Server-Side Request Forgery in WildFire

PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

PAN-OS: Exposure of Sensitive Information Vulnerability

PAN-OS: Predictable temporary file vulnerability

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator

PAN-OS: Session Token Disclosure Vulnerability

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface