Palo Alto Networks paloaltonetworks pan-os

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passwords in authd.log, which allows context-dependent attackers to obtain sensitive information by reading this file, aka Ref ID 35493.

PAN-OS: User Impersonation in GlobalProtect SSL VPN

PAN-OS: OS Command Argument Injection in Web Interface

PAN-OS: Plaintext Disclosure of External System Integration Credentials

PAN-OS: Server-Side Request Forgery in WildFire

PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

PAN-OS: Exposure of Sensitive Information Vulnerability

PAN-OS: Predictable temporary file vulnerability

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator

PAN-OS: Session Token Disclosure Vulnerability

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes

PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface

PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly

PAN-OS: Configuration secrets for log forwarding may be logged in system logs

The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195.

Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.

The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.

The web-based management UI in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote attackers to obtain verbose error information via crafted input, aka Ref ID 33139.

Cross-site scripting (XSS) vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS before 5.0.15, 5.1.x before 5.1.10, and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Ref ID 64563.

The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export files via unspecified parameters.

PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss

PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)

PAN-OS: Weak Cryptography Used in Web Interface Authentication

XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.

PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs

PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history

PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

PAN-OS: System proxy passwords may be logged in clear text while viewing system state

PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator

PAN-OS: Secrets for scheduled configuration exports are logged in system logs