CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1581 – PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
https://notcve.org/view.php?id=CVE-2019-1581
23 Aug 2019 — A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4. Una vulnerabilidad de ejecución remota de código en la interfaz de administración de dispositivos SSH de PAN-OS ... • https://security.paloaltonetworks.com/CVE-2019-1581 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1580
https://notcve.org/view.php?id=CVE-2019-1580
23 Aug 2019 — Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory. La corrupción de la memoria en PAN-OS 7.1.24 y anteriores, PAN-OS 8.0.19 y anteriores, PAN-OS 8.1.9 y anteriores, y PAN-OS 9.0.3 y anteriores permitirá que un usuario remoto no autenticado elabore un mensaje para proteger Shell Daemon (SSHD) y corromper la memo... • https://security.paloaltonetworks.com/CVE-2019-1580 • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 95%CPEs: 3EXPL: 3CVE-2019-1579 – Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-1579
19 Jul 2019 — Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code. La ejecución de código remota en PAN-OS versión 7.1.18 y anteriores, PAN-OS versión 8.0.11-h1 y anteriores, y PAN-OS versión 8.1.2 y anteriores con GlobalProtect Portal o GlobalProtect Gateway Interface habilitados pueden permitir que un atacante remoto no aut... • https://github.com/securifera/CVE-2019-1579 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-1575
https://notcve.org/view.php?id=CVE-2019-1575
16 Jul 2019 — Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them. Una divulgación de información en PAN-OS versiones 7.1.23 y anteriores, PAN-OS versiones 8.0.18 y anteriores, PAN-OS versiones 8.1.8-h4 y anteriores, y PAN-OS versione... • http://www.securityfocus.com/bid/109176 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
26 Feb 2019 — If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order ... • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1566
https://notcve.org/view.php?id=CVE-2019-1566
30 Jan 2019 — The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. La interfaz de gestión web de PAN-OS, en versiones 7.1.21 y anteriores, en las 8.0.14 y anteriores y en las 8.1.5 y anteriores, puede permitir a un atacante no autenticado inyectar JavaScript o HTML arbitrario. • http://www.securityfocus.com/bid/106750 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1565
https://notcve.org/view.php?id=CVE-2019-1565
30 Jan 2019 — The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML. Las listas dinámicas externas en PAN-OS, en versiones 7.1.21 y anteriores, en las 8.0.14 y anteriores y en las 8.1.5 y anteriores, podrían permitir que un atacante autenticado en Next Generation Firewall con permisos ... • http://www.securityfocus.com/bid/106752 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10141
https://notcve.org/view.php?id=CVE-2018-10141
12 Oct 2018 — GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML. La página GlobalProtect Portal Login en Palo Alto Networks PAN-OS en versiones anteriores a la 8.1.4 permite que un atacante no autenticado inyecte JavaScript o HTML arbitrarios. • https://security.paloaltonetworks.com/CVE-2018-10141 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 2CVE-2018-18065 – net-snmp 5.7.3 - (Authenticated) Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2018-18065
08 Oct 2018 — _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. _set_key en agent/helpers/table_container.c en Net-SNMP en versiones anteriores a la 5.8 tiene un error de excepción de puntero NULL que puede ser empleado por un atacante autenticado para provocar el cierre inesperado de la instancia de forma remota mediante un paque... • https://www.exploit-db.com/exploits/45547 • CWE-476: NULL Pointer Dereference •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10139
https://notcve.org/view.php?id=CVE-2018-10139
16 Aug 2018 — The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected. La página de respuesta PAN-OS para GlobalProtect Gateway en Palo Alto Networks PAN-OS 6.1.21 y anteriores, PAN-OS 7.1.18 y anteriores, PAN-OS 8.0.11 y anteriores podría permitir que un atacante no autenticado inyecte código HTML o JavaScript arbitrario. PAN-... • http://www.securityfocus.com/bid/105111 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •