CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-1999 – PAN-OS: Threat signatures are evaded by specifically crafted packets
https://notcve.org/view.php?id=CVE-2020-1999
12 Nov 2020 — A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0. Se presen... • https://security.paloaltonetworks.com/CVE-2020-1999 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 9.3EPSS: 66%CPEs: 5EXPL: 1CVE-2020-2034 – PAN-OS: OS command injection vulnerability in GlobalProtect portal
https://notcve.org/view.php?id=CVE-2020-2034
08 Jul 2020 — An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN... • https://github.com/blackhatethicalhacking/CVE-2020-2034-POC • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2030 – PAN-OS: OS command injection vulnerability in the management interface
https://notcve.org/view.php?id=CVE-2020-2030
08 Jul 2020 — An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0, PAN-OS 9.1, or Prisma Access services. Una vulnerabilidad de Inyección de Comandos del Sistema Operativo en la interfaz de administración de PAN-OS, permite a administradores autenticados ej... • https://security.paloaltonetworks.com/CVE-2020-2030 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2029 – PAN-OS: OS command injection vulnerability in management interface certificate generator
https://notcve.org/view.php?id=CVE-2020-2029
10 Jun 2020 — An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. Una vulnerabilidad de inyección de comandos del Sistema Operativo en la interfaz de administración web d... • https://security.paloaltonetworks.com/CVE-2020-2029 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2028 – PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification
https://notcve.org/view.php?id=CVE-2020-2028
10 Jun 2020 — An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Una vulnerabilidad de inyección de comandos del Sistema Operativo en el servidor de administración de PAN-OS, permite a administradores autenticados... • https://security.paloaltonetworks.com/CVE-2020-2028 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2027 – PAN-OS: Buffer overflow in authd authentication response
https://notcve.org/view.php?id=CVE-2020-2027
10 Jun 2020 — A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Una vulnerabilidad de desbordamiento del búfer en el componente authd del servidor de administración PAN-OS, permite a administradores autenti... • https://security.paloaltonetworks.com/CVE-2020-2027 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2018 – PAN-OS: Panorama authentication bypass vulnerability
https://notcve.org/view.php?id=CVE-2020-2018
13 May 2020 — An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue does not affect Panorama configured with custom certificates authentication for communication between Panorama and managed devices. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions ear... • https://security.paloaltonetworks.com/CVE-2020-2018 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2017 – PAN-OS: DOM-Based cross site scripting vulnerability in management web interface
https://notcve.org/view.php?id=CVE-2020-2017
13 May 2020 — A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0. ... • https://security.paloaltonetworks.com/CVE-2020-2017 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2016 – PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation
https://notcve.org/view.php?id=CVE-2020-2016
13 May 2020 — A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions... • https://security.paloaltonetworks.com/CVE-2020-2016 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-377: Insecure Temporary File •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-2015 – PAN-OS: Buffer overflow in the management server
https://notcve.org/view.php?id=CVE-2020-2015
13 May 2020 — A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0. Una vulnerabilidad de desbordamiento del búfer en el servidor de administración de PAN-OS permite a los usuarios autentificad... • https://security.paloaltonetworks.com/CVE-2020-2015 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •