Threat database

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechanisms using this vulnerability.

EPSS <0.1%VulnerabilityPalo Alto Networks#cwe-346United States+9

An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.

A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online. This affects the following hardware firewall models: - PA-5400 Series firewalls - PA-7000 Series firewalls

A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled.

An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected.

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

EPSS 0.2%VulnerabilityPalo Alto Networks#cwe-59Germany+6

CVE-2022-0028 is a vulnerability in Palo Alto Networks PAN-OS where a URL filtering policy misconfiguration can enable a network attacker to perform reflected and amplified TCP denial-of-service (RDoS) attacks. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2017-15944 is a high-severity vulnerability in Palo Alto Networks PAN-OS that involves multiple unspecified flaws which, when chained, can lead to remote code execution. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2020-2021 is a high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting its SAML implementation. This flaw allows attackers to bypass authentication mechanisms, potentially gaining unauthorized access. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2019-1579 is a high-severity remote code execution vulnerability in Palo Alto Networks PAN-OS affecting systems with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.