CVE Vulnerability Catalog

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The risk is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses. Cloud NGFW, Panorama, and Prisma Access are not affected.

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

A type confusion vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.

A command injection vulnerability in the Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobrancas_geracao.php endpoint accepts POST data via extract($_REQUEST) and inserts it directly into an INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data, or delete database tables.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobranca.php endpoint accepts POST input via extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data.

Prior to 3.8.6, WeGIA's auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute.

Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables, allowing arbitrary SQL execution.

In WeGIA prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.

In WeGIA prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(), and the installer writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement.

In FileRise prior to 3.15.0, public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared.

In InvoiceShelf version 2.3.3 and earlier, bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. An authenticated user can submit another company's identifier and delete cross-company records.

Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can enter the ORDER BY clause, enabling boolean-based blind extraction of database information.

In InvoiceShelf prior to version 2.4.0, PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses.

In InvoiceShelf prior to version 2.4.0, invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers.

Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes.

Prior to version 2.4.0, InvoiceShelf NotesController::show, update, and destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy, so neither method checks the target note's company_id. An authenticated staff user can read, modify, or delete another company's note templates.