CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2030 – PAN-OS: OS command injection vulnerability in the management interface
https://notcve.org/view.php?id=CVE-2020-2030
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0, PAN-OS 9.1, or Prisma Access services. Una vulnerabilidad de Inyección de Comandos del Sistema Operativo en la interfaz de administración de PAN-OS, permite a administradores autenticados ejecutar comandos arbitrarios de Sistema Operativo con privilegios root. Este problema afecta a versiones PAN-OS 8.1 anteriores a PAN-OS 8.1.15; y todas las versiones de PAN-OS 7.1 y PAN-OS 8.0. • https://security.paloaltonetworks.com/CVE-2020-2030 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1982 – PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services
https://notcve.org/view.php?id=CVE-2020-1982
Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered services. We do not believe that any communication is impacted as a result of known attacks against TLS 1.0. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.14; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. • https://security.paloaltonetworks.com/CVE-2020-1982 • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 1CVE-2020-2021 – Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-2021
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. • https://github.com/mr-r3b00t/CVE-2020-2021 https://security.paloaltonetworks.com/CVE-2020-2021 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2029 – PAN-OS: OS command injection vulnerability in management interface certificate generator
https://notcve.org/view.php?id=CVE-2020-2029
An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. Una vulnerabilidad de inyección de comandos del Sistema Operativo en la interfaz de administración web de PAN-OS, permite a administradores autenticados ejecutar comandos arbitrarios del Sistema Operativo con privilegios root mediante el envío de una petición maliciosa para generar nuevos certificados para su uso en la configuración de PAN-OS. Este problema afecta a: Todas las versiones de PAN-OS 8.0; PAN-OS versiones 7.1 anteriores a PAN-OS versión 7.1.26; PAN-OS versiones 8.1 anteriores a PAN-OS versión 8.1.13 • https://security.paloaltonetworks.com/CVE-2020-2029 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2028 – PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification
https://notcve.org/view.php?id=CVE-2020-2028
An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Una vulnerabilidad de inyección de comandos del Sistema Operativo en el servidor de administración de PAN-OS, permite a administradores autenticados ejecutar comandos arbitrarios del sistema operativo con privilegios root al cargar un nuevo certificado en modo FIPS-CC. Este problema afecta: Todas las versiones de PAN-OS 7.1 y PAN-OS versión 8.0; PAN-OS versiones 8.1 anteriores a PAN-OS 8.1.13; PAN-OS versiones 9.0 anteriores a PAN-OS 9.0.7 • https://security.paloaltonetworks.com/CVE-2020-2028 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •