CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-15943
https://notcve.org/view.php?id=CVE-2017-15943
The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities. La importación de archivos de configuración para las funcionalidades de objetos de aplicaciones, spyware y vulnerabilidades en la interfaz web en Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19 y versiones 7.1.x anteriores a la 7.1.14 permite que atacantes remotos lleven a cabo ataques de SSRF (Server-Side Request Forgery) y, consecuentemente, obtengan información sensible mediante vectores relacionados con el análisis sintáctico de entidades externas. • http://www.securityfocus.com/bid/102074 http://www.securitytracker.com/id/1040005 https://security.paloaltonetworks.com/CVE-2017-15943 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 6%CPEs: 4EXPL: 0CVE-2017-15940
https://notcve.org/view.php?id=CVE-2017-15940
The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors. El componente de gestión de captura de paquetes de la interfaz web en Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 7.1.14 y versiones 8.0.x anteriores a la 8.0.6 permite que usuarios autenticados remotos ejecuten código arbitrario mediante vectores sin especificar. • http://www.securityfocus.com/bid/102076 http://www.securitytracker.com/id/1040006 https://security.paloaltonetworks.com/CVE-2017-15940 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-15942
https://notcve.org/view.php?id=CVE-2017-15942
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service via vectors related to the management interface. Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 7.1.13 y versiones 8.0.x anteriores a la 8.0.6 permite que atacantes remotos provoquen una denegación de servicio (DoS) mediante vectores relacionados con la interfaz de gestión. • http://www.securityfocus.com/bid/102075 http://www.securitytracker.com/id/1040004 https://security.paloaltonetworks.com/CVE-2017-15942 •
CVSS: 9.8EPSS: 97%CPEs: 4EXPL: 4CVE-2017-15944 – Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-15944
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.19; versiones 7.0.x anteriores a la 7.0.19; versiones 7.1.x anteriores a la 07/01/2014 y versiones 8.0.x anteriores a la 8.0.6 permite que atacantes remotos ejecuten código arbitrario mediante vectores relacionados con la interfaz de gestión. Three separate bugs can be used together to remotely execute commands as root through the web management interface without authentication on PAN-OS versions 6.1.18 and earlier, PAN-OS versions 7.0.18 and earlier, PAN-OS versions 7.1.13 and earlier, and PAN-OS versions 8.0.5 and earlier. Full details provided. Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. • https://www.exploit-db.com/exploits/43342 https://www.exploit-db.com/exploits/44597 https://github.com/xxnbyy/CVE-2017-15944-POC https://github.com/yukar1z0e/CVE-2017-15944 http://www.securityfocus.com/bid/102079 http://www.securitytracker.com/id/1040007 https://security.paloaltonetworks.com/CVE-2017-15944 https://seclists.org/fulldisclosure/2017/Dec/38 •
CVSS: 6.1EPSS: 0%CPEs: 29EXPL: 0CVE-2017-12416
https://notcve.org/view.php?id=CVE-2017-12416
Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper request parameter validation. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en la interfaz de puerta de enlace interna y externa de GlobalProtect en Palo Alto Networks PAN-OS en versiones anteriores a la 6.1.18, versiones 7.0.x anteriores a la 7.0.17, versiones 7.1.x anteriores a la 7.1.12 y versiones 8.0.x anteriores a la 8.0.3 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante vectores relacionados con la validación inadecuada de parámetros request. • http://www.securityfocus.com/bid/100619 http://www.securitytracker.com/id/1039255 https://security.paloaltonetworks.com/CVE-2017-12416 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •