Palo Alto Networks PAN-OS vulnerabilities

Palo Alto Networks PAN-OS versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allow remote attackers to cause a denial of service via vectors related to the management interface.

The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via unspecified request parameters.

Palo Alto Networks PAN-OS versions before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allow local users to gain privileges via crafted values of unspecified environment variables.

Palo Alto Networks PAN-OS versions before 5.0.19, 5.1.x before 5.1.12, 6.0.x before 6.0.14, 6.1.x before 6.1.12, and 7.0.x before 7.0.8 may allow local users to gain privileges by leveraging improper sanitization of the root_reboot local invocation.

The device management command line interface (CLI) in Palo Alto Networks PAN-OS before version 5.0.18 and in versions 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma Access are not affected by this vulnerability.

The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before version 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code.

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.

An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software allows an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted.

A command injection vulnerability in Palo Alto Networks PAN-OS software allows an authenticated administrator to bypass system restrictions and run arbitrary commands as root. The user must have access to the PAN-OS CLI or Web UI to exploit this issue.

A vulnerability exists in Palo Alto Networks PAN-OS software that allows an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.