Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-29653 State: PUBLISHED Published: 2022-04-13T12:02:10 Last Updated: 2024-08-04T16:55:10.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Froxlor/Froxlor/commits/master - https://github.com/Froxlor/Froxlor/security/advisories - https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
CVE ID: CVE-2020-29654 State: PUBLISHED Published: 2020-12-11T23:46:01 Last Updated: 2024-08-04T16:55:10.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity/wdc-20011-western-digital-dashboard-privilege-escalation
CVE ID: CVE-2020-29655 State: PUBLISHED Published: 2020-12-09T08:00:58 Last Updated: 2024-08-04T16:55:10.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter productname within the title. An attacker might be able to influence the appearance of the login page, aka text injection. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.165678
CVE ID: CVE-2020-29656 State: PUBLISHED Published: 2020-12-09T08:00:42 Last Updated: 2024-08-04T16:55:10.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unspecified "public exploit." Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.165677
CVE ID: CVE-2020-29657 State: PUBLISHED Published: 2020-12-09T08:06:13 Last Updated: 2024-08-04T16:55:10.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JerryScript 2.3.0, there is an out-of-bounds read in main_print_unhandled_exception in the main-utils.c file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4244
CVE ID: CVE-2020-29658 State: PUBLISHED Published: 2021-03-05T08:44:49 Last Updated: 2024-08-04T16:55:10.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/application-control/knowledge-base/privilege-escalation-vulnerability-open-SSL.html
CVE ID: CVE-2020-29659 State: PUBLISHED Published: 2020-12-09T16:13:31 Last Updated: 2024-08-04T16:55:10.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by overflowing the sid parameter via a GET /settings&sid= attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49217 - https://www.dupscout.com - https://fluidattacks.com/advisories/prine/
CVE ID: CVE-2020-29660 State: PUBLISHED Published: 2020-12-09T16:57:56 Last Updated: 2024-08-04T16:55:10.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 - http://www.openwall.com/lists/oss-security/2020/12/10/1 - https://lists.fedoraproject.org/archives/list/package-annou
- http://www.openwall.com/lists/oss-security/2020/12/10/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP/ - https://security.netapp.com/advisory/ntap-20210122-0001/ - https://www.debian.org/security/2021/dsa-4843 - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html
CVE ID: CVE-2020-29661 State: PUBLISHED Published: 2020-12-09T16:57:41 Last Updated: 2024-08-04T16:55:10.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=54ffccbf053b5b6ca4f6e45094b942fab92a25fc - http://www.openwall.com/lists/oss-security/2020/12/10/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZ7O
ity/2020/12/10/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZ7OAKAEFAXQRGBZK4LYUWINCD3D2XCL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOB25SU6XUL4TNP7KB63WNZSYTIYFDPP/ - https://www.debian.org/security/2021/dsa-4843 - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://www.oracle.com/security-alerts/cpuoct2021.html - http://packetstormsecurity.com/files/160681/Linux-TIOCSPGRP-Broken-Locking.html - https://security.netapp.com/advisory/ntap-20210122-0001/ - http://packetstormsecurity.com/
OCSPGRP-Broken-Locking.html - https://security.netapp.com/advisory/ntap-20210122-0001/ - http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html
CVE ID: CVE-2020-29662 State: PUBLISHED Published: 2021-02-02T20:54:33 Last Updated: 2024-08-04T16:55:10.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goharbor/harbor/security/advisories/GHSA-38r5-34mr-mvm7
CVE ID: CVE-2020-29663 State: PUBLISHED Published: 2020-12-15T22:15:35 Last Updated: 2024-08-04T16:55:10.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Icinga/icinga2/compare/v2.12.1...v2.12.2 - https://github.com/Icinga/icinga2/security/advisories/GHSA-pcmr-2p2f-r7j6
CVE ID: CVE-2020-29664 State: PUBLISHED Published: 2021-02-18T12:59:43 Last Updated: 2024-08-04T16:55:10.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet. Additional Analyst Notes: - CVE Program Container: References: - http://hacktheplanet.nu/djihax.pdf - http://kth.diva-portal.org/smash/get/diva2:1463784/FULLTEXT01.pdf - https://www.dji.com/mavic-2 - https://gist.github.com/viktoredstrom/2f0463ebe7cd786904f229e11386e817
CVE ID: CVE-2020-29666 State: PUBLISHED Published: 2020-12-10T08:06:50 Last Updated: 2024-08-04T16:55:10.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value. Additional Analyst Notes: - CVE Program Container: References: - http://lanatmservice.ru/ - https://github.com/jet-pentest/CVE-2020-29666
CVE ID: CVE-2020-29667 State: PUBLISHED Published: 2020-12-10T08:07:32 Last Updated: 2024-08-04T16:55:10.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration. Additional Analyst Notes: - CVE Program Container: References: - http://lanatmservice.ru/ - https://github.com/jet-pentest/CVE-2020-29667
CVE ID: CVE-2020-29668 State: PUBLISHED Published: 2020-12-10T07:53:33 Last Updated: 2024-08-04T16:55:10.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sympa-community/sympa/issues/1041 - https://github.com/sympa-community/sympa/pull/1044 - https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 - https://lists.debian.org/debian-lts-announce
.59b.2/NEWS.md - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 - https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html - https://www.debian.org/security/2020/dsa-4818 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/
CVE ID: CVE-2020-29669 State: PUBLISHED Published: 2020-12-14T01:39:12 Last Updated: 2024-08-04T16:55:10.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password hashes of each user (including root) can be dumped. The root hash can be cracked easily which results in a complete system compromise. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1PpiR
ystem compromise. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1PpiRhhfph8U_0KAoIp0AnwY3mVtp-R-g/view - https://github.com/S1lkys/CVE-2020-29669 - http://packetstormsecurity.com/files/160478/Macally-WIFISD2-2A82-2.000.010-Privilege-Escalation.html
CVE ID: CVE-2020-2000 State: PUBLISHED Published: 2020-11-12T00:05:20.120304Z Last Updated: 2024-09-16T16:58:42.346Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-20, CWE-78, CWE-121 Description: An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS
an PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2000
CVE ID: CVE-2020-2001 State: PUBLISHED Published: 2020-05-13T19:07:14.106961Z Last Updated: 2024-09-16T20:48:20.875Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-123 Description: An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All PAN-OS 7.1 Panorama and 8.0 Panorama versions; PAN-OS 8.1 versions earlier than 8.1.12 on Panorama; PAN-OS 9.0 versions earlier than 9.
rama and 8.0 Panorama versions; PAN-OS 8.1 versions earlier than 8.1.12 on Panorama; PAN-OS 9.0 versions earlier than 9.0.6 on Panorama. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2001
CVE ID: CVE-2020-2002 State: PUBLISHED Published: 2020-05-13T19:07:14.142942Z Last Updated: 2024-09-17T04:03:36.143Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-290 Description: An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. This affects all forms of authentication that use a Kerberos authentication profile. A man-in-the-middle type of attacker with the ability to intercept communication between PAN-OS a
uthentication profile. A man-in-the-middle type of attacker with the ability to intercept communication between PAN-OS and KDC can login to PAN-OS as an administrator. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All version of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2002
CVE ID: CVE-2020-2003 State: PUBLISHED Published: 2020-05-13T19:07:14.185214Z Last Updated: 2024-09-16T23:05:50.686Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-73 Description: An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions before 8.1.14; PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.1. Additional Analyst Notes: -
versions before 8.1.14; PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2003
CVE ID: CVE-2020-2004 State: PUBLISHED Published: 2020-05-13T19:07:14.220187Z Last Updated: 2024-09-17T01:30:43.892Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-534 Description: Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows. For this issue to occur all of these conditions must be true: (1) 'Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalPro
Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, (3) and the logging level is set to 'Dump' while collecting troubleshooting logs. This issue does not affect GlobalProtect app on other platforms (for example iOS/Android/Linux). This issue affects GlobalProtect app 5.0 versions earlier than 5.0.9, GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the known GlobalProtectLogs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to C
gs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to Customer Support. The GlobalProtectLogs zip files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2004
CVE ID: CVE-2020-2005 State: PUBLISHED Published: 2020-05-13T19:07:14.255122Z Last Updated: 2024-09-17T03:27:58.741Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://se
lier than 9.0.7; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2005
CVE ID: CVE-2020-2006 State: PUBLISHED Published: 2020-05-13T19:07:14.307575Z Last Updated: 2024-09-16T16:57:44.922Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2006
CVE ID: CVE-2020-2007 State: PUBLISHED Published: 2020-05-13T19:07:14.342957Z Last Updated: 2024-09-17T03:08:00.990Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2007
CVE ID: CVE-2020-2008 State: PUBLISHED Published: 2020-05-13T19:07:14.381957Z Last Updated: 2024-09-16T17:08:04.547Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-73, CWE-78 Description: An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14. Additional Analyst Notes: - CVE Program Contain
versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2008
CVE ID: CVE-2020-2009 State: PUBLISHED Published: 2020-05-13T19:07:14.419045Z Last Updated: 2024-09-16T18:07:53.255Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-73 Description: An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases this results in arbitrary code execution with root permissions. This issue affects: All versions of PAN-OS 7.1; PAN-OS 8.1 versions earlier than 8.1.14;
xecution with root permissions. This issue affects: All versions of PAN-OS 7.1; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2009
CVE ID: CVE-2020-2010 State: PUBLISHED Published: 2020-05-13T19:07:14.455972Z Last Updated: 2024-09-16T16:33:43.415Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2010
CVE ID: CVE-2020-2011 State: PUBLISHED Published: 2020-05-13T19:07:14.502947Z Last Updated: 2024-09-16T23:26:56.835Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-20 Description: An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a specifically crafted registration request to the device that causes the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode. This i
denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode. This issue affects: All versions of PAN-OS 7.1, PAN-OS 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2011
CVE ID: CVE-2020-2012 State: PUBLISHED Published: 2020-05-13T19:07:14.538223Z Last Updated: 2024-09-17T04:24:36.796Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-611 Description: Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than
norama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2012