CVSS: 8.7EPSS: 64%CPEs: 2EXPL: 3CVE-2024-3393 – Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
https://notcve.org/view.php?id=CVE-2024-3393
27 Dec 2024 — A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remot... • https://packetstorm.news/files/id/188673 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.3EPSS: 94%CPEs: 5EXPL: 11CVE-2024-9474 – Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-9474
18 Nov 2024 — A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability. Una vulnerabilidad de escalada de privilegios en el software PAN-OS de Palo Alto Networks permite que un administrador de PAN-OS con acceso a la interfaz web de administración realice acciones en el firewall con privilegios de superusuar... • https://packetstorm.news/files/id/183312 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 94%CPEs: 4EXPL: 14CVE-2024-0012 – Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-0012
18 Nov 2024 — An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting acce... • https://packetstorm.news/files/id/183312 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-2550 – PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet
https://notcve.org/view.php?id=CVE-2024-2550
14 Nov 2024 — A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Una vulnerabilidad de desreferencia de puntero nulo en la puerta de enlace GlobalProtect del software PAN-OS de Palo Alto Networks permit... • https://security.paloaltonetworks.com/CVE-2024-2550 • CWE-476: NULL Pointer Dereference •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-5920 – PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator
https://notcve.org/view.php?id=CVE-2024-5920
14 Nov 2024 — A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser. Una vulnerabilidad de cross-site scripting (XSS) en el software PAN-OS de Palo Alto Networks permite que un ad... • https://security.paloaltonetworks.com/CVE-2024-5920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-5917 – PAN-OS: Server-Side Request Forgery in WildFire
https://notcve.org/view.php?id=CVE-2024-5917
14 Nov 2024 — A server-side request forgery in PAN-OS software enables an unauthenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Server-side request forgeryen el software PAN-OS permite a un atacante no autenticado utilizar la interfaz web administrativa como proxy, lo que le permite ver recursos de red internos que de otra manera no serían accesibles. A server-side request forgery in PAN-OS software enables an a... • https://security.paloaltonetworks.com/CVE-2024-5917 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-2552 – PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)
https://notcve.org/view.php?id=CVE-2024-2552
14 Nov 2024 — A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall. Una vulnerabilidad de inyección de comandos en el software PAN-OS de Palo Alto Networks permite a un administrador autenticado eludir las restricciones del sistema en el plano de administración y eliminar archivos en el firewall. • https://security.paloaltonetworks.com/CVE-2024-2552 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-5918 – PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User
https://notcve.org/view.php?id=CVE-2024-5918
14 Nov 2024 — An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate." Una vulnerabilidad de validación de certificado incorrecta en el software PAN-OS de Palo Alto Networks permite que un usuario autorizado con un ce... • https://security.paloaltonetworks.com/CVE-2024-5918 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-5919 – PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-5919
14 Nov 2024 — A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface. Una vulnerabilidad de inyección ciega de entidades externas XML (XXE) en el software PAN-OS de Palo Alto Networks permite a un atacante autenticado extraer archivos arbitrarios de los firewalls a un servidor controlado por ... • https://security.paloaltonetworks.com/CVE-2024-5919 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2551 – PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet
https://notcve.org/view.php?id=CVE-2024-2551
14 Nov 2024 — A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Una vulnerabilidad de desreferencia de puntero nulo en el software PAN-OS de Palo Alto Networks permite a un atacante no autenticado detener un servicio cent... • https://security.paloaltonetworks.com/CVE-2024-2551 • CWE-476: NULL Pointer Dereference •