CVE-2019-1566

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Palo Alto Networks	Palo Alto Networks PAN-OS	PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier.

References

http://www.securityfocus.com/bid/106750Third Party Advisory, VDB Entry
https://security.paloaltonetworks.com/CVE-2019-1566Vendor Advisory
https://www.purplemet.com/blog/palo-alto-firewall-multiple-xss-vulnerabilitiesThird Party Advisory
http://www.securityfocus.com/bid/106750Third Party Advisory, VDB Entry
https://security.paloaltonetworks.com/CVE-2019-1566Vendor Advisory
https://www.purplemet.com/blog/palo-alto-firewall-multiple-xss-vulnerabilitiesThird Party Advisory

Timeline

Published: Jan 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156608.8The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-156617.2An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate parameters, leadi CVE-2019-156622.7An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed CVE-2019-156632.7An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed CVE-2019-156642.7An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed CVE-2019-156657.2An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate an offset passed CVE-2019-156664.4An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause CVE-2019-15675.4The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping CVE-2019-156789.8TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This a CVE-2019-156799.8TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.CVE-2019-15686.1Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrar CVE-2019-156807.5TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack