CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1995 – PAN-OS: Management server rasmgr denial of service
https://notcve.org/view.php?id=CVE-2020-1995
13 May 2020 — A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 versions earlier than 9.1.2. Una vulnerabilidad de desreferencia del puntero NULL en Palo Alto Networks PAN-OS, permite a un administrador autenticado enviar una ... • https://security.paloaltonetworks.com/CVE-2020-1995 • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1994 – PAN-OS: Predictable temporary file vulnerability
https://notcve.org/view.php?id=CVE-2020-1994
13 May 2020 — A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7. Una vulnerabilidad de archivo temporal predecible en PAN-OS, permite a un usuario autenticado local con acceso de shell corromper archivos de sistema arbitrarios afectando la integridad del sistema... • https://security.paloaltonetworks.com/CVE-2020-1994 • CWE-377: Insecure Temporary File •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1993 – PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
https://notcve.org/view.php?id=CVE-2020-1993
13 May 2020 — The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8. La funcionalidad GlobalProtect Portal en PAN-OS, no establece un nuevo identificador de sesión después de un inicio de sesión de usuario con éxito, que permite ataques de f... • https://security.paloaltonetworks.com/CVE-2020-1993 • CWE-384: Session Fixation •
CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 0CVE-2020-1992 – PAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation
https://notcve.org/view.php?id=CVE-2020-1992
08 Apr 2020 — A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a denial of service condition or potentially execute code with root privileges. This issue affects Palo Alto Networks PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.2 on PA-7000 Series devices with an LFC installed and configured. This issue requires WildFire services to be configured and enabled. This issue does not a... • https://security.paloaltonetworks.com/CVE-2020-1992 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2020-1990 – PAN-OS: Buffer overflow in the management server
https://notcve.org/view.php?id=CVE-2020-1990
08 Apr 2020 — A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuration and potentially execute code with root privileges. This issue affects Palo Alto Networks PAN-OS 8.1 versions before 8.1.13; 9.0 versions before 9.0.7. This issue does not affect PAN-OS 7.1. Una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria en el componente servidor de administración de PAN-OS, permite a un usuario autent... • https://security.paloaltonetworks.com/CVE-2020-1990 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1978 – VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs
https://notcve.org/view.php?id=CVE-2020-1978
08 Apr 2020 — TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves.... • https://security.paloaltonetworks.com/CVE-2020-1978 • CWE-255: Credentials Management Errors CWE-522: Insufficiently Protected Credentials •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1979 – PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation
https://notcve.org/view.php?id=CVE-2020-1979
11 Mar 2020 — A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions. Una vulnerabilidad de la cadena de formato en el demonio de registro ... • https://security.paloaltonetworks.com/CVE-2020-1979 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1980 – PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands
https://notcve.org/view.php?id=CVE-2020-1980
11 Mar 2020 — A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions. This issue is fixed in PAN-OS 8.1.13, and all later versions. Una vulnerabilidad de inyección de comando de shell en la CLI de PAN-OS, permite a un usuario autenticado local escapar del shell restringido y escalar p... • https://security.paloaltonetworks.com/CVE-2020-1980 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1981 – PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation
https://notcve.org/view.php?id=CVE-2020-1981
11 Mar 2020 — A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions. Una vulnerabilidad de nombre predecible de archivo temporal en PAN-OS, permite una escalada... • https://security.paloaltonetworks.com/CVE-2020-1981 • CWE-377: Insecure Temporary File CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1975 – Missing XML Validation in PAN-OS Web Interface
https://notcve.org/view.php?id=CVE-2020-1975
12 Feb 2020 — Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. Se presenta una vulnerabilidad de falta de comprobación XML en la interfaz web PAN-OS en el software Palo Alto Networks... • https://security.paloaltonetworks.com/CVE-2020-1975 • CWE-112: Missing XML Validation CWE-611: Improper Restriction of XML External Entity Reference •