Kajetan Rostojek

Palo Alto Networks PAN-OS software is affected by a cross-site scripting (XSS) issue, which allows an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator, who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate administrator's browser. An exploit for this issue is available, with more information accessible at https://t.co/tF8CkcjpgX and https://t.co/RlZWNQvLLs. Unfortunately, the specific versions of the vulnerable software are not mentioned in the provided text. #PaloAltoNetworks #PANOS #XSS #CrossSiteScripting #AuthenticatedXSS #PANOSsoftware #NetworkSecurity #CyberSecurity

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server (affected versions not specified) Description: The issue is related to a spoofing vulnerability in Microsoft SharePoint Server, where the structure of a web page is not properly protected. This could allow a remote attacker to conduct spoofing attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows an administrative user of WebReports to perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.

The console may experience a service interruption when processing file names with invalid characters.

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system, leading to complete system compromise.

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system, leading to complete system compromise.

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system, leading to complete system compromise.

A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

The issue is related to a cross-site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization. This could allow a remote attacker to execute arbitrary code.

The issue is related to a cross-site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner, potentially leading to a takeover of the user account. This vulnerability is associated with a lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting attacks.

A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access.

A cross-site scripting (XSS) vulnerability in the Web Reports component can possibly allow an attack to exploit an application parameter during execution of the Save Report.

A cross-site scripting (XSS) issue in the Web Reports component can allow an attacker to execute malicious javascript code into a webpage, potentially accessing stored cookie information.

A cross-site scripting (XSS) issue in the Web Reports component can possibly allow an attacker to execute malicious javascript code into a webpage, attempting to retrieve cookie-stored information.

A cross-site scripting (XSS) vulnerability exists in the Web Reports component of HCL BigFix Platform due to a missing specific HTTP header attribute.

A reflected cross-site scripting (XSS) vulnerability in the Web Reports component can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.

A cross-site scripting (XSS) issue in the PAN-OS software allows a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. When viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator. The vulnerability is related to the lack of protection of the web page structure, which can be exploited by a remote attacker to perform cross-site scripting attacks.

A DOM-Based cross-site scripting (XSS) vulnerability in the PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface. The vulnerability exists due to inadequate protection of the web page structure, allowing an attacker to perform cross-site scripting attacks using a specially crafted link.

A credential disclosure issue in the web interface of PAN-OS software allows an authenticated read-only administrator to obtain plaintext credentials of stored external system integrations, including LDAP, SCP, RADIUS, TACACS+, and SNMP. This issue is related to insufficient protection of registration data.

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system. The issue is related to errors in processing hyperlinks, which can be exploited by a remote attacker to gain access to confidential data.