CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1978 – VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs
https://notcve.org/view.php?id=CVE-2020-1978
TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. • https://security.paloaltonetworks.com/CVE-2020-1978 • CWE-255: Credentials Management Errors CWE-522: Insufficiently Protected Credentials •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1975 – Missing XML Validation in PAN-OS Web Interface
https://notcve.org/view.php?id=CVE-2020-1975
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. Se presenta una vulnerabilidad de falta de comprobación XML en la interfaz web PAN-OS en el software Palo Alto Networks PAN-OS, permite a usuarios autenticados inyectar XML arbitrario que resulta en una escalada de privilegios. Este problema afecta a PAN-OS versiones 8.1 anteriores a PAN-OS 8.1.12 y PAN-OS versiones 9.0 anteriores a PAN-OS 9.0.6. • https://security.paloaltonetworks.com/CVE-2020-1975 • CWE-112: Missing XML Validation CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17440 – PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access
https://notcve.org/view.php?id=CVE-2019-17440
Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. • https://security.paloaltonetworks.com/CVE-2019-17440 • CWE-923: Improper Restriction of Communication Channel to Intended Endpoints •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-17437 – PAN-OS: Custom-role users may escalate privileges
https://notcve.org/view.php?id=CVE-2019-17437
An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9.0 versions prior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue. Una comprobación de autenticación inapropiada en PAN-OS de Palo Alto Networks puede permitir a un usuario de rol personalizado no superusuario poco privilegiado autenticado elevar los privilegios y convertirse en superusuario. Este problema afecta a PAN-OS versiones 7.1 anteriores a 7.1.25; versiones 8.0 anteriores a 8.0.20; versiones 8.1 anteriores a 8.1.11; versiones 9.0 anteriores a 9.0.5. • https://securityadvisories.paloaltonetworks.com/Home/Detail/159 • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1582
https://notcve.org/view.php?id=CVE-2019-1582
Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session. La corrupción de la memoria en PAN-OS 8.1.9 y anteriores, y PAN-OS 9.0.3 y anteriores permitirá a un usuario administrativo causar daños arbitrarios en la memoria al volver a escribir la sesión interactiva actual del cliente. • https://security.paloaltonetworks.com/CVE-2019-1582 • CWE-787: Out-of-bounds Write •