Rotem Bar

Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.

A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Cloud NGFW and Panorama are not affected by this vulnerability.

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption. Panorama and Prisma® Access are not affected by this vulnerability.

O problema está relacionado à proteção insuficiente da estrutura da página da web, permitindo que um invasor remoto execute scripts entre sites. Trata-se de uma vulnerabilidade de Cross-Site Scripting (XSS) refletido baseada em DOM. Estima-se que mais de 6,5 milhões de sites estejam potencialmente afetados. A vulnerabilidade pode ser explorada manipulando o parâmetro `settings` no endpoint `/wp-content/plugins/elementor/assets/js/frontend.min.js`, especificamente usando o `elementor-action` com `action=lightbox` e `settings` manipulados para injetar scripts maliciosos.

A vulnerabilidade permite que um usuário com privilégios já existente enumere serviços em escuta ou interaja com recursos configurados por meio de solicitações HTTP, excedendo o escopo pretendido do plugin Alerting.