CVSS: 9.0EPSS: 1%CPEs: 4EXPL: 0CVE-2020-2000 – PAN-OS: OS command injection and memory corruption vulnerability
https://notcve.org/view.php?id=CVE-2020-2000
12 Nov 2020 — An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Una vulnerabilidad de corrupción de memoria e inyección... • https://security.paloaltonetworks.com/CVE-2020-2000 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-121: Stack-based Buffer Overflow •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-1999 – PAN-OS: Threat signatures are evaded by specifically crafted packets
https://notcve.org/view.php?id=CVE-2020-1999
12 Nov 2020 — A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0. Se presen... • https://security.paloaltonetworks.com/CVE-2020-1999 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-2044 – PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history
https://notcve.org/view.php?id=CVE-2020-2044
09 Sep 2020 — An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage is recorded, instead, in the req_stats.log file in PAN-OS 9.1 and later PAN-OS ve... • https://security.paloaltonetworks.com/CVE-2020-2044 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2043 – PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs
https://notcve.org/view.php?id=CVE-2020-2043
09 Sep 2020 — An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earli... • https://security.paloaltonetworks.com/CVE-2020-2043 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2020-2042 – PAN-OS: Buffer overflow in the management web interface
https://notcve.org/view.php?id=CVE-2020-2042
09 Sep 2020 — A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Una vulnerabilidad de desbordamiento de búfer en la interfaz web de administración de PAN-OS permite a los administradores autenticados interrumpir los procesos del sistema y potencialmente ejecutar código arbitrario con privilegios root. Este... • https://security.paloaltonetworks.com/CVE-2020-2042 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 2%CPEs: 2EXPL: 0CVE-2020-2041 – PAN-OS: Management web interface denial-of-service (DoS)
https://notcve.org/view.php?id=CVE-2020-2041
09 Sep 2020 — An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts all versions of PAN-OS 8.0, and PAN-OS 8.1 versions earlier than 8.1.16. Una configuración no segura del demonio appweb de Palo A... • https://security.paloaltonetworks.com/CVE-2020-2041 • CWE-16: Configuration •
CVSS: 10.0EPSS: 1%CPEs: 4EXPL: 0CVE-2020-2040 – PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled
https://notcve.org/view.php?id=CVE-2020-2040
09 Sep 2020 — A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. Una vulnerabilidad de desbordamiento de búfer en PAN-OS permit... • https://security.paloaltonetworks.com/CVE-2020-2040 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.3EPSS: 6%CPEs: 4EXPL: 0CVE-2020-2039 – PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload
https://notcve.org/view.php?id=CVE-2020-2039
09 Sep 2020 — An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-... • https://security.paloaltonetworks.com/CVE-2020-2039 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.0EPSS: 92%CPEs: 3EXPL: 6CVE-2020-2038 – PAN-OS: OS command injection vulnerability in the management web interface
https://notcve.org/view.php?id=CVE-2020-2038
09 Sep 2020 — An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1. Una vulnerabilidad de Inyección de Comandos del Sistema Operativo en la interfaz de administración de PAN-OS que permite a los administradores autenticados ejecutar comandos de Sistema Operativo arbit... • https://packetstorm.news/files/id/168008 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 1%CPEs: 3EXPL: 0CVE-2020-2037 – PAN-OS: OS command injection vulnerability in the management web interface
https://notcve.org/view.php?id=CVE-2020-2037
09 Sep 2020 — An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. Una vulnerabilidad de inyección de comandos de Sistema Operativo en la interfaz de administración de PAN-OS que permite a los administradores autenticados ejecutar comandos de Sist... • https://security.paloaltonetworks.com/CVE-2020-2037 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •