admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-05-07 11:06:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2020-05-13 20:01:25 +00:00
parent 0b7cbae49a
commit 6008937e93
No known key found for this signature in database
GPG Key ID: 5708902F06FEF743
26 changed files with 109 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
2019/20xxx/CVE-2019-20795.json
View File

@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
"value": "iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c."
"value": "iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability."
}
]
},
@ -56,6 +56,11 @@
"refsource": "CONFIRM",
"name": "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10",
"url": "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10"
},
{
"refsource": "MISC",
"name": "https://bugzilla.suse.com/show_bug.cgi?id=1171452",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1171452"
}
]
}

7
2020/1xxx/CVE-2020-1979.json
View File

@ -70,7 +70,7 @@
"description_data": [
{
"lang": "eng",
"value": "A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges.\nThis issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama.\nThis issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions."
"value": "A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions."
}
]
},
@ -108,8 +108,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1979"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1979",
"name": "https://security.paloaltonetworks.com/CVE-2020-1979"
}
]
},

7
2020/1xxx/CVE-2020-1993.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID.\nThis issue affects:\nAll PAN-OS 7.1 and 8.0 versions;\nPAN-OS 8.1 versions earlier than 8.1.14;\nPAN-OS 9.0 versions earlier than 9.0.8."
"value": "The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1993"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1993",
"name": "https://security.paloaltonetworks.com/CVE-2020-1993"
}
]
},

7
2020/1xxx/CVE-2020-1994.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system.\n\nThis issue affects:\nAll versions of PAN-OS 7.1 and 8.0;\nPAN-OS 8.1 versions earlier than 8.1.13;\nPAN-OS 9.0 versions earlier than 9.0.7.\n"
"value": "A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1994"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1994",
"name": "https://security.paloaltonetworks.com/CVE-2020-1994"
}
]
},

7
2020/1xxx/CVE-2020-1995.json
View File

@ -49,7 +49,7 @@
"description_data": [
{
"lang": "eng",
"value": "A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.\nThis issue affects:\n\nPAN-OS 9.1 versions earlier than 9.1.2."
"value": "A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 versions earlier than 9.1.2."
}
]
},
@ -87,8 +87,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1995"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1995",
"name": "https://security.paloaltonetworks.com/CVE-2020-1995"
}
]
},

7
2020/1xxx/CVE-2020-1996.json
View File

@ -69,7 +69,7 @@
"description_data": [
{
"lang": "eng",
"value": "A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file\nThis issue affects:\n\nAll versions of PAN-OS 7.1 and 8.0;\n\nPAN-OS 8.1 versions earlier than 8.1.14;\n\nPAN-OS 9.0 versions earlier than 9.0.9."
"value": "A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.9."
}
]
},
@ -107,8 +107,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1996"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1996",
"name": "https://security.paloaltonetworks.com/CVE-2020-1996"
}
]
},

7
2020/1xxx/CVE-2020-1997.json
View File

@ -68,7 +68,7 @@
"description_data": [
{
"lang": "eng",
"value": "An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates it will cause them to access an unexpected and potentially malicious website.\nThis issue affects:\n\nPAN-OS 7.1 versions earlier than 7.1.26;\n\nPAN-OS 8.0 versions earlier than 8.0.14.\n"
"value": "An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates it will cause them to access an unexpected and potentially malicious website. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.14."
}
]
},
@ -106,8 +106,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1997"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1997",
"name": "https://security.paloaltonetworks.com/CVE-2020-1997"
}
]
},

7
2020/1xxx/CVE-2020-1998.json
View File

@ -89,7 +89,7 @@
"description_data": [
{
"lang": "eng",
"value": "An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user.\nThis issue affects:\n\nPAN-OS 7.1 versions earlier than 7.1.26;\n\nPAN-OS 8.0 versions earlier than 8.0.21;\n\nPAN-OS 8.1 versions earlier than 8.1.13;\n\nPAN-OS 9.0 versions earlier than 9.0.6;\n\nPAN-OS 9.1 versions earlier than 9.1.1."
"value": "An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1."
}
]
},
@ -127,8 +127,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-1998"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-1998",
"name": "https://security.paloaltonetworks.com/CVE-2020-1998"
}
]
},

7
2020/2xxx/CVE-2020-2001.json
View File

@ -74,7 +74,7 @@
"description_data": [
{
"lang": "eng",
"value": "An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges.\nThis issue affects:\n\nAll PAN-OS 7.1 Panorama versions;\n\nPAN-OS 8.0 versions earlier than 8.0.21 on Panorama;\n\nPAN-OS 8.1 versions earlier than 8.1.12 on Panorama;\n\nPAN-OS 9.0 versions earlier than 9.0.6 on Panorama."
"value": "An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All PAN-OS 7.1 Panorama versions; PAN-OS 8.0 versions earlier than 8.0.21 on Panorama; PAN-OS 8.1 versions earlier than 8.1.12 on Panorama; PAN-OS 9.0 versions earlier than 9.0.6 on Panorama."
}
]
},
@ -112,8 +112,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2001"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2001",
"name": "https://security.paloaltonetworks.com/CVE-2020-2001"
}
]
},

7
2020/2xxx/CVE-2020-2002.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. This affects all forms of authentication that use a Kerberos authentication profile. A man-in-the-middle type of attacker with the ability to intercept communication between PAN-OS and KDC can login to PAN-OS as an administrator. \nThis issue affects:\nPAN-OS 7.1 versions earlier than 7.1.26;\nPAN-OS 8.0 versions earlier than 8.0.21;\nPAN-OS 8.1 versions earlier than 8.1.13;\nPAN-OS 9.0 versions earlier than 9.0.6.\n"
"value": "An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. This affects all forms of authentication that use a Kerberos authentication profile. A man-in-the-middle type of attacker with the ability to intercept communication between PAN-OS and KDC can login to PAN-OS as an administrator. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2002"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2002",
"name": "https://security.paloaltonetworks.com/CVE-2020-2002"
}
]
},

7
2020/2xxx/CVE-2020-2003.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services.\n\nThis issue affects:\nAll versions of PAN-OS 7.1;\nPAN-OS 8.1 versions before 8.1.14;\nPAN-OS 9.0 versions before 9.0.7;\nPAN-OS 9.1 versions before 9.1.1."
"value": "An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1; PAN-OS 8.1 versions before 8.1.14; PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.1."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2003"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2003",
"name": "https://security.paloaltonetworks.com/CVE-2020-2003"
}
]
},

11
2020/2xxx/CVE-2020-2004.json
View File

@ -61,7 +61,7 @@
"description_data": [
{
"lang": "eng",
"value": "Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows.\n\nFor this issue to occur all of these conditions must be true: (1) 'Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, (3) and the logging level is set to 'Dump' while collecting troubleshooting logs.\n\nThis issue does not affect GlobalProtect app on other platforms (for example iOS/Android/Linux).\n\nThis issue affects GlobalProtect app 5.0 versions earlier than 5.0.9, GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS.\n\nSince becoming aware of the issue, Palo Alto Networks has safely deleted all the known GlobalProtectLogs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to Customer Support.\n\nThe GlobalProtectLogs zip files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials."
"value": "Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows. For this issue to occur all of these conditions must be true: (1) 'Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, (3) and the logging level is set to 'Dump' while collecting troubleshooting logs. This issue does not affect GlobalProtect app on other platforms (for example iOS/Android/Linux). This issue affects GlobalProtect app 5.0 versions earlier than 5.0.9, GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the known GlobalProtectLogs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to Customer Support. The GlobalProtectLogs zip files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials."
}
]
},
@ -99,8 +99,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2004"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2004",
"name": "https://security.paloaltonetworks.com/CVE-2020-2004"
}
]
},
@ -126,7 +127,7 @@
"work_around": [
{
"lang": "eng",
"value": "Multiple workarounds exists for this issue:\n1. Do not set the 'Logging Level' option to 'Dump' while collecting troubleshooting logs. This issue does not occur when the 'Logging Level' is set to 'Debug'.\n2. Set the 'Save User Credential' option to 'No' in the GlobalProtect Portal's Agent configuration.\n3. Use Single-Sign-On (SSO) feature instead of the ‘Save User Credential’ option."
"value": "Multiple workarounds exists for this issue:\n1. Do not set the 'Logging Level' option to 'Dump' while collecting troubleshooting logs. This issue does not occur when the 'Logging Level' is set to 'Debug'.\n2. Set the 'Save User Credential' option to 'No' in the GlobalProtect Portal's Agent configuration.\n3. Use Single-Sign-On (SSO) feature instead of the \u2018Save User Credential\u2019 option."
}
]
}
}

7
2020/2xxx/CVE-2020-2005.json
View File

@ -85,7 +85,7 @@
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session.\nThis issue affects:\n\nPAN-OS 7.1 versions earlier than 7.1.26;\nPAN-OS 8.0 versions earlier than 8.0.21;\nPAN-OS 8.1 versions earlier than 8.1.13;\nPAN-OS 9.0 versions earlier than 9.0.7."
"value": "A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -123,8 +123,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2005"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2005",
"name": "https://security.paloaltonetworks.com/CVE-2020-2005"
}
]
},

7
2020/2xxx/CVE-2020-2006.json
View File

@ -59,7 +59,7 @@
"description_data": [
{
"lang": "eng",
"value": "A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges.\nThis issue affects:\n\nAll versions of PAN-OS 7.1 and 8.0;\n\nPAN-OS 8.1 versions earlier than 8.1.14."
"value": "A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14."
}
]
},
@ -97,8 +97,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2006"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2006",
"name": "https://security.paloaltonetworks.com/CVE-2020-2006"
}
]
},

7
2020/2xxx/CVE-2020-2007.json
View File

@ -69,7 +69,7 @@
"description_data": [
{
"lang": "eng",
"value": "An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges.\nThis issue affects:\n\nAll PAN-OS 7.1 versions;\n\nPAN-OS 8.1 versions earlier than 8.1.14;\n\nPAN-OS 9.0 versions earlier than 9.0.7. "
"value": "An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -107,8 +107,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2007"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2007",
"name": "https://security.paloaltonetworks.com/CVE-2020-2007"
}
]
},

7
2020/2xxx/CVE-2020-2008.json
View File

@ -69,7 +69,7 @@
"description_data": [
{
"lang": "eng",
"value": "An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition.\nThis issue affects:\nAll versions of PAN-OS 7.1 and 8.0;\nPAN-OS 8.1 versions earlier than 8.1.14."
"value": "An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14."
}
]
},
@ -115,8 +115,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2008"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2008",
"name": "https://security.paloaltonetworks.com/CVE-2020-2008"
}
]
},

7
2020/2xxx/CVE-2020-2009.json
View File

@ -69,7 +69,7 @@
"description_data": [
{
"lang": "eng",
"value": "An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases this results in arbitrary code execution with root permissions.\nThis issue affects:\n\nAll versions of PAN-OS 7.1;\n\nPAN-OS 8.1 versions earlier than 8.1.14;\n\nPAN-OS 9.0 versions earlier than 9.0.7."
"value": "An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases this results in arbitrary code execution with root permissions. This issue affects: All versions of PAN-OS 7.1; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -107,8 +107,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2009"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2009",
"name": "https://security.paloaltonetworks.com/CVE-2020-2009"
}
]
},

7
2020/2xxx/CVE-2020-2010.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges.\nThis issue affects:\nAll versions of PAN-OS 7.1 and 8.0;\nPAN-OS 8.1 versions earlier than 8.1.14;\nPAN-OS 9.0 versions earlier than 9.0.7."
"value": "An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2010"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2010",
"name": "https://security.paloaltonetworks.com/CVE-2020-2010"
}
]
},

7
2020/2xxx/CVE-2020-2011.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a specifically crafted registration request to the device that causes the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode.\nThis issue affects:\n\nAll versions of PAN-OS 7.1, PAN-OS 8.0;\n\nPAN-OS 8.1 versions earlier than 8.1.14;\n\nPAN-OS 9.0 versions earlier than 9.0.7;\n\nPAN-OS 9.1 versions earlier than 9.1.0."
"value": "An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a specifically crafted registration request to the device that causes the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode. This issue affects: All versions of PAN-OS 7.1, PAN-OS 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.0."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2011"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2011",
"name": "https://security.paloaltonetworks.com/CVE-2020-2011"
}
]
},

7
2020/2xxx/CVE-2020-2012.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system.\n\nThis issue affects:\nAll versions of PAN-OS for Panorama 7.1 and 8.0;\nPAN-OS for Panorama 8.1 versions earlier than 8.1.13;\nPAN-OS for Panorama 9.0 versions earlier than 9.0.7.\n"
"value": "Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2012"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2012",
"name": "https://security.paloaltonetworks.com/CVE-2020-2012"
}
]
},

9
2020/2xxx/CVE-2020-2013.json
View File

@ -89,7 +89,7 @@
"description_data": [
{
"lang": "eng",
"value": "A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama.\nThis issue affects:\n\nPAN-OS 7.1 versions earlier than 7.1.26;\n\nPAN-OS 8.0 versions earlier than 8.0.21;\n\nPAN-OS 8.1 versions earlier than 8.1.13;\n\nPAN-OS 9.0 versions earlier than 9.0.6;\n\nand PAN-OS 9.1 versions earlier than 9.1.1."
"value": "A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; and PAN-OS 9.1 versions earlier than 9.1.1."
}
]
},
@ -127,8 +127,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2013"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2013",
"name": "https://security.paloaltonetworks.com/CVE-2020-2013"
}
]
},
@ -154,7 +155,7 @@
"work_around": [
{
"lang": "eng",
"value": "One possible vulnerability mitigation is to shorten the length of administrator session idle timeout. This reduces the likelihood the exposed administrator’s session cookie is valid at time of attack."
"value": "One possible vulnerability mitigation is to shorten the length of administrator session idle timeout. This reduces the likelihood the exposed administrator\u2019s session cookie is valid at time of attack."
},
{
"lang": "eng",

7
2020/2xxx/CVE-2020-2014.json
View File

@ -74,7 +74,7 @@
"description_data": [
{
"lang": "eng",
"value": "An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges.\n\nThis issue affects:\nAll versions of PAN-OS 7.1 and 8.0;\nPAN-OS 8.1 versions earlier than 8.1.14;\nPAN-OS 9.0 versions earlier than 9.0.7.\n"
"value": "An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7."
}
]
},
@ -112,8 +112,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2014"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2014",
"name": "https://security.paloaltonetworks.com/CVE-2020-2014"
}
]
},

7
2020/2xxx/CVE-2020-2015.json
View File

@ -94,7 +94,7 @@
"description_data": [
{
"lang": "eng",
"value": "A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges.\n\nThis issue affects:\nPAN-OS 7.1 versions earlier than 7.1.26;\nPAN-OS 8.0 versions earlier than 8.0.21;\nPAN-OS 8.1 versions earlier than 8.1.13;\nPAN-OS 9.0 versions earlier than 9.0.7;\nPAN-OS 9.1 versions earlier than 9.1.1.\n\n"
"value": "A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.1."
}
]
},
@ -132,8 +132,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2015"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2015",
"name": "https://security.paloaltonetworks.com/CVE-2020-2015"
}
]
},

7
2020/2xxx/CVE-2020-2016.json
View File

@ -93,7 +93,7 @@
"description_data": [
{
"lang": "eng",
"value": "A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account.\n\nThis allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user."
"value": "A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user."
}
]
},
@ -137,8 +137,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2016"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2016",
"name": "https://security.paloaltonetworks.com/CVE-2020-2016"
}
]
},

7
2020/2xxx/CVE-2020-2017.json
View File

@ -89,7 +89,7 @@
"description_data": [
{
"lang": "eng",
"value": "A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces.\nA remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions.\n\nThis issue affects:\nPAN-OS 7.1 versions earlier than 7.1.26;\nPAN-OS 8.0 versions earlier than 8.0.21;\nPAN-OS 8.1 versions earlier than 8.1.13;\nPAN-OS 9.0 versions earlier than 9.0.6."
"value": "A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6."
}
]
},
@ -127,8 +127,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2017"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2017",
"name": "https://security.paloaltonetworks.com/CVE-2020-2017"
}
]
},

7
2020/2xxx/CVE-2020-2018.json
View File

@ -79,7 +79,7 @@
"description_data": [
{
"lang": "eng",
"value": "An authentication bypass vulnerability in Palo Alto Networks PAN-OS Panorama proxy service allows an unauthenticated user with network access to Panorama and the knowledge of the Firewall’s serial number to register the PAN-OS firewall to register the device. After the PAN-OS device is registered, the user can further compromise the PAN-OS instances managed by Panorama.\nThis issue affects:\n\nPAN-OS 7.1 versions earlier than 7.1.26;\n\nPAN-OS 8.0 versions earlier than 8.0.21;\n\nPAN-OS 8.1 versions earlier than 8.1.12;\n\nPAN-OS 9.0 versions earlier than 9.0.6."
"value": "An authentication bypass vulnerability in Palo Alto Networks PAN-OS Panorama proxy service allows an unauthenticated user with network access to Panorama and the knowledge of the Firewall\u2019s serial number to register the PAN-OS firewall to register the device. After the PAN-OS device is registered, the user can further compromise the PAN-OS instances managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.21; PAN-OS 8.1 versions earlier than 8.1.12; PAN-OS 9.0 versions earlier than 9.0.6."
}
]
},
@ -117,8 +117,9 @@
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2020-2018"
"refsource": "MISC",
"url": "https://security.paloaltonetworks.com/CVE-2020-2018",
"name": "https://security.paloaltonetworks.com/CVE-2020-2018"
}
]
},