Palo Alto Networks vulnerabilities
364 CVEs and advisories name Palo Alto Networks as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-3044Cortex XSOAR: Unauthorized Usage of the REST API
- CVE-2021-3041Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation
- CVE-2021-3040Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
- CVE-2021-3039Prisma Cloud Compute: User role authorization secret for Console leaked through log file export
- CVE-2021-3038GlobalProtect App: Windows VPN kernel driver denial of service (DoS)
- CVE-2021-3037PAN-OS: Secrets for scheduled configuration exports are logged in system logs
- CVE-2021-3036PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly
- CVE-2021-3035Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
- CVE-2021-3034Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logs
- CVE-2021-3033Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console
- CVE-2021-3032PAN-OS: Configuration secrets for log forwarding may be logged in system logs
- CVE-2021-3031PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)
- CVE-2020-2049Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation
- CVE-2020-2020Cortex XDR Agent: Exceptional condition denial-of-service (DoS)
- CVE-2020-2050PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification
- CVE-2020-2048PAN-OS: System proxy passwords may be logged in clear text while viewing system state
- CVE-2020-2022PAN-OS: Panorama session disclosure during context switch into managed device
- CVE-2020-2000PAN-OS: OS command injection and memory corruption vulnerability
- CVE-2020-1999PAN-OS: Threat signatures are evaded by specifically crafted packets
- CVE-2020-2044PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history
- CVE-2020-2043PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs
- CVE-2020-2042PAN-OS: Buffer overflow in the management web interface
- CVE-2020-2041PAN-OS: Management web interface denial-of-service (DoS)
- CVE-2020-2040PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled
- CVE-2020-2039PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload
- CVE-2020-2038PAN-OS: OS command injection vulnerability in the management web interface
- CVE-2020-2037PAN-OS: OS command injection vulnerability in the management web interface
- CVE-2020-2036PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface
- CVE-2020-2035PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions
- CVE-2020-2034PAN-OS: OS command injection vulnerability in GlobalProtect portal