CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-3382 – PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets
https://notcve.org/view.php?id=CVE-2024-3382
10 Apr 2024 — A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled. • https://security.paloaltonetworks.com/CVE-2024-3382 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 2CVE-2024-2433 – PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss
https://notcve.org/view.php?id=CVE-2024-2433
13 Mar 2024 — An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected. Una vulnerabilidad de autorización inadecuada en el software Pa... • https://github.com/nitipoom-jar/CVE-2024-24337 • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-0008 – PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
https://notcve.org/view.php?id=CVE-2024-0008
14 Feb 2024 — Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access. Las sesiones web en la interfaz de administración del software PAN-OS de Palo Alto Networks no caducan en determinadas situaciones, lo que las hace susceptibles a accesos no autorizados. • https://security.paloaltonetworks.com/CVE-2024-0008 • CWE-613: Insufficient Session Expiration •
CVSS: 3.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6793 – PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator
https://notcve.org/view.php?id=CVE-2023-6793
13 Dec 2023 — An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage. Vulnerabilidad de administración de privilegios inadecuada en el software PAN-OS de Palo Alto Networks permite a un administrador de solo lectura autenticado revocar claves API XML activas desde el firewall e interrumpir el uso de la API XML. • https://security.paloaltonetworks.com/CVE-2023-6793 • CWE-269: Improper Privilege Management •
CVSS: 4.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6789 – PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
https://notcve.org/view.php?id=CVE-2023-6789
13 Dec 2023 — A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator. Vulnerabilidad de cross-site scripting (XSS) en el software PAN-OS de Palo Alto Networks permite a un administrador de lectu... • https://security.paloaltonetworks.com/CVE-2023-6789 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •