CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-15941
https://notcve.org/view.php?id=CVE-2017-15941
Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Palo Alto Networks PAN-OS en versiones anteriores a 6.1.19, 7.0.x anteriores a 7.0.19, 7.1.x anteriores a 7.1.14 y 8.0.x anteriores a 8.0.7, cuando la puerta de enlace o portal GlobalProtect está configurado, permite que los atacantes remotos inyecten scripts web o HTML arbitrarios mediante vectores no especificados. • http://www.securityfocus.com/bid/102446 http://www.securitytracker.com/id/1040147 https://security.paloaltonetworks.com/CVE-2017-15941 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-15943
https://notcve.org/view.php?id=CVE-2017-15943
The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities. La importación de archivos de configuración para las funcionalidades de objetos de aplicaciones, spyware y vulnerabilidades en la interfaz web en Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19 y versiones 7.1.x anteriores a la 7.1.14 permite que atacantes remotos lleven a cabo ataques de SSRF (Server-Side Request Forgery) y, consecuentemente, obtengan información sensible mediante vectores relacionados con el análisis sintáctico de entidades externas. • http://www.securityfocus.com/bid/102074 http://www.securitytracker.com/id/1040005 https://security.paloaltonetworks.com/CVE-2017-15943 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 6%CPEs: 4EXPL: 0CVE-2017-15940
https://notcve.org/view.php?id=CVE-2017-15940
The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors. El componente de gestión de captura de paquetes de la interfaz web en Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 7.1.14 y versiones 8.0.x anteriores a la 8.0.6 permite que usuarios autenticados remotos ejecuten código arbitrario mediante vectores sin especificar. • http://www.securityfocus.com/bid/102076 http://www.securitytracker.com/id/1040006 https://security.paloaltonetworks.com/CVE-2017-15940 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-15942
https://notcve.org/view.php?id=CVE-2017-15942
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service via vectors related to the management interface. Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 7.1.13 y versiones 8.0.x anteriores a la 8.0.6 permite que atacantes remotos provoquen una denegación de servicio (DoS) mediante vectores relacionados con la interfaz de gestión. • http://www.securityfocus.com/bid/102075 http://www.securitytracker.com/id/1040004 https://security.paloaltonetworks.com/CVE-2017-15942 •
CVSS: 9.8EPSS: 97%CPEs: 4EXPL: 5CVE-2017-15944 – Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-15944
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 07/01/2014 y versiones 8.0.x anteriores a la 8.0.6 permite que atacantes remotos ejecuten código arbitrario mediante vectores relacionados con la interfaz de gestión. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on PAN-OS versions 6.1.18 and earlier, PAN-OS versions 7.0.18 and earlier, PAN-OS versions 7.1.13 and earlier, and PAN-OS versions 8.0.5 and earlier. Full details provided. Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. • https://www.exploit-db.com/exploits/43342 https://www.exploit-db.com/exploits/44597 https://github.com/xxnbyy/CVE-2017-15944-POC https://github.com/yukar1z0e/CVE-2017-15944 http://www.securityfocus.com/bid/102079 http://www.securitytracker.com/id/1040007 https://security.paloaltonetworks.com/CVE-2017-15944 https://seclists.org/fulldisclosure/2017/Dec/38 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/panos_readsessionvars.rb •