8.1.12

DATE	CVE	VULNERABILITY TITLE	RISK
2020-05-13	CVE-2020-2002	Authentication Bypass by Spoofing vulnerability in Paloaltonetworks Pan-Os An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. network high complexity paloaltonetworks CWE-290	8.1
2020-05-13	CVE-2020-1998	Incorrect Authorization vulnerability in Paloaltonetworks Pan-Os An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. network low complexity paloaltonetworks CWE-863	8.8
2020-05-13	CVE-2020-1996	Missing Authorization vulnerability in Paloaltonetworks Pan-Os A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. network low complexity paloaltonetworks CWE-862	5.3
2020-05-13	CVE-2020-1994	Unspecified vulnerability in Paloaltonetworks Pan-Os A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. local low complexity paloaltonetworks	4.4
2020-05-13	CVE-2020-1993	Session Fixation vulnerability in Paloaltonetworks Pan-Os The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. network low complexity paloaltonetworks CWE-384	5.4
2020-04-08	CVE-2020-1990	Out-of-bounds Write vulnerability in Paloaltonetworks Pan-Os A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuration and potentially execute code with root privileges. network low complexity paloaltonetworks CWE-787	7.2
2020-03-11	CVE-2020-1981	Exposure of Resource to Wrong Sphere vulnerability in Paloaltonetworks Pan-Os A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. local low complexity paloaltonetworks CWE-668	7.8
2020-03-11	CVE-2020-1980	OS Command Injection vulnerability in Paloaltonetworks Pan-Os A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. local low complexity paloaltonetworks CWE-78	7.8
2020-03-11	CVE-2020-1979	Use of Externally-Controlled Format String vulnerability in Paloaltonetworks Pan-Os A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and escalating privileges. local low complexity paloaltonetworks CWE-134	7.8