CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2048 – PAN-OS: System proxy passwords may be logged in clear text while viewing system state
https://notcve.org/view.php?id=CVE-2020-2048
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2. Se presenta una exposición de información mediante una vulnerabilidad del archivo de registro donde la contraseña para el servidor proxy del sistema configurado para un dispositivo PAN-OS puede mostrarse en texto sin cifrar cuando es usada la CLI en el software PAN-OS de Palo Alto Networks. Este problema afecta: versiones PAN-OS 8.1 anteriores a PAN-OS 8.1.17; versiones PAN-OS 9.0 anteriores a PAN-OS 9.0.11; versiones PAN-OS 9.1 anteriores a PAN-OS 9.1.2 • https://security.paloaltonetworks.com/CVE-2020-2048 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2022 – PAN-OS: Panorama session disclosure during context switch into managed device
https://notcve.org/view.php?id=CVE-2020-2022
An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5. Se presenta una vulnerabilidad de exposición de información en el software Panorama de Palo Alto Networks que revela el token de sesión del administrador de la interfaz web de Panorama a un dispositivo administrado cuando el administrador de Panorama lleva a cabo un cambio de contexto en ese dispositivo. • https://security.paloaltonetworks.com/CVE-2020-2022 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2000 – PAN-OS: OS command injection and memory corruption vulnerability
https://notcve.org/view.php?id=CVE-2020-2000
An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Una vulnerabilidad de corrupción de memoria e inyección de comandos del Sistema Operativo en la interfaz web de administración de PAN-OS que permite a los administradores autenticados interrumpir los procesos del sistema y ejecutar potencialmente código arbitrario y comandos del Sistema Operativo con privilegios root. Este problema afecta: versiones PAN-OS 8.1 anteriores a PAN-OS 8.1.16; versiones PAN-OS 9.0 anteriores a PAN-OS 9.0.10; versiones PAN-OS 9.1 anteriores a PAN-OS 9.1.4; versiones PAN-OS 10.0 anteriores a PAN-OS 10.0.1 • https://security.paloaltonetworks.com/CVE-2020-2000 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-121: Stack-based Buffer Overflow •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-1999 – PAN-OS: Threat signatures are evaded by specifically crafted packets
https://notcve.org/view.php?id=CVE-2020-1999
A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0. Se presenta una vulnerabilidad en el motor de detección de amenazas basado en firmas de PAN-OS de Palo Alto Network que permite a un atacante comunicarse con dispositivos en la red de una manera que no se analiza en busca de amenazas mediante el envío de datos mediante paquetes TCP específicamente diseñados. Esta técnica evade la detección de amenazas basada en firmas. • https://security.paloaltonetworks.com/CVE-2020-1999 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2044 – PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history
https://notcve.org/view.php?id=CVE-2020-2044
An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage is recorded, instead, in the req_stats.log file in PAN-OS 9.1 and later PAN-OS versions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. • https://security.paloaltonetworks.com/CVE-2020-2044 • CWE-532: Insertion of Sensitive Information into Log File •