CVSS: 6.6EPSS: 0%CPEs: 6EXPL: 0CVE-2024-0008 – PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
https://notcve.org/view.php?id=CVE-2024-0008
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access. Las sesiones web en la interfaz de administración del software PAN-OS de Palo Alto Networks no caducan en determinadas situaciones, lo que las hace susceptibles a accesos no autorizados. • https://security.paloaltonetworks.com/CVE-2024-0008 • CWE-613: Insufficient Session Expiration •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0007 – PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
https://notcve.org/view.php?id=CVE-2024-0007
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator. Una vulnerabilidad de Cross-Site Scripting (XSS) en el software PAN-OS de Palo Alto Networks permite a un administrador de lectura y escritura autenticado malicioso almacenar un payload de JavaScript utilizando la interfaz web en los dispositivos Panorama. Esto permite la suplantación de otro administrador autenticado. • https://security.paloaltonetworks.com/CVE-2024-0007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 7EXPL: 0CVE-2023-6791 – PAN-OS: Plaintext Disclosure of External System Integration Credentials
https://notcve.org/view.php?id=CVE-2023-6791
A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface. Vulnerabilidad de divulgación de credenciales en el software PAN-OS de Palo Alto Networks permite a un administrador autenticado de solo lectura obtener las credenciales en texto plano de integraciones de sistemas externos almacenados, como LDAP, SCP, RADIUS, TACACS+ y SNMP desde la interfaz web. • https://security.paloaltonetworks.com/CVE-2023-6791 • CWE-522: Insufficiently Protected Credentials CWE CATEGORY •
CVSS: 4.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6789 – PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
https://notcve.org/view.php?id=CVE-2023-6789
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator. Vulnerabilidad de cross-site scripting (XSS) en el software PAN-OS de Palo Alto Networks permite a un administrador de lectura y escritura autenticado malicioso almacenar un payload de JavaScript mediante la interfaz web. Luego, cuando la ve un administrador autenticado correctamente, la payload de JavaScript se ejecuta y disfraza todas las acciones asociadas tal como las realiza ese administrador autenticado desprevenido. • https://security.paloaltonetworks.com/CVE-2023-6789 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6795 – PAN-OS: OS Command Injection Vulnerability in the Web Interface
https://notcve.org/view.php?id=CVE-2023-6795
An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Vulnerabilidad de inyección de comandos del sistema operativo en el software PAN-OS de Palo Alto Networks permite a un administrador autenticado interrumpir los procesos del sistema y potencialmente ejecutar código arbitrario con privilegios limitados en el firewall. • https://security.paloaltonetworks.com/CVE-2023-6795 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •