CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2024-5913 – PAN-OS: Improper Input Validation Vulnerability in PAN-OS
https://notcve.org/view.php?id=CVE-2024-5913
An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges. Una vulnerabilidad de validación de entrada incorrecta en el software PAN-OS de Palo Alto Networks permite a un atacante manipular el sistema de archivos físico para elevar los privilegios. • https://security.paloaltonetworks.com/CVE-2024-5913 • CWE-20: Improper Input Validation •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-5911 – PAN-OS: File Upload Vulnerability in the Panorama Web Interface
https://notcve.org/view.php?id=CVE-2024-5911
An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online. Una vulnerabilidad de carga de archivos arbitraria en el software Panorama de Palo Alto Networks permite que un administrador de lectura y escritura autenticado con acceso a la interfaz web interrumpa los procesos del sistema y bloquee Panorama. Los ataques repetidos eventualmente hacen que Panorama entre en modo de mantenimiento, lo que requiere intervención manual para volver a ponerlo en línea. • https://security.paloaltonetworks.com/CVE-2024-5911 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 96%CPEs: 70EXPL: 35CVE-2024-3400 – Palo Alto Networks PAN-OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-3400
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. Una vulnerabilidad de inyección de comandos en la función GlobalProtect del software PAN-OS de Palo Alto Networks para versiones específicas de PAN-OS y configuraciones de funciones distintas puede permitir que un atacante no autenticado ejecute código arbitrario con privilegios de root en el firewall. Cloud NGFW, dispositivos Panorama y Prisma Access no se ven afectados por esta vulnerabilidad. Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. • https://github.com/W01fh4cker/CVE-2024-3400-RCE https://github.com/h4x0r-dz/CVE-2024-3400 https://www.exploit-db.com/exploits/51996 https://github.com/ak1t4/CVE-2024-3400 https://github.com/marconesler/CVE-2024-3400 https://github.com/swaybs/CVE-2024-3400 https://github.com/Kr0ff/cve-2024-3400 https://github.com/0x0d3ad/CVE-2024-3400 https://github.com/W01fh4cker/CVE-2024-3400-RCE-Scan https://github.com/Yuvvi01/CVE-2024-3400 https://github.com/momika233&#x • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.1EPSS: 0%CPEs: 4EXPL: 1CVE-2024-3388 – PAN-OS: User Impersonation in GlobalProtect SSL VPN
https://notcve.org/view.php?id=CVE-2024-3388
A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets. • https://github.com/Grantzile/PoC-CVE-2024-33883 https://security.paloaltonetworks.com/CVE-2024-3388 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-3387 – PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2024-3387
A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls. • https://security.paloaltonetworks.com/CVE-2024-3387 • CWE-326: Inadequate Encryption Strength •