{"cve_id":"CVE-2020-2036","title":"Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting","severity":"high","actively_exploited":false,"patterns":["/unauth/php/change_password.php/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E","/php/change_password.php/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E","/_404_/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E","/global-protect/login.esp"],"events":68811,"unique_ips":345,"actors":[{"ip":"79.124.58.126","events":49690,"country_code":"BG","country":"Bulgaria","org":"Tamatiya EOOD","rdns":"ip-58-126.4vendeta.com","scanner_tag":null},{"ip":"185.93.89.121","events":11459,"country_code":"IR","country":"Iran","org":"Limited Network LTD","rdns":"","scanner_tag":null},{"ip":"213.209.159.5","events":1997,"country_code":"TW","country":"Taiwan","org":"Feo Prest SRL","rdns":"","scanner_tag":null},{"ip":"213.209.159.186","events":700,"country_code":"TW","country":"Taiwan","org":"Feo Prest SRL","rdns":"","scanner_tag":null},{"ip":"45.142.193.24","events":588,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.198","events":457,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.213","events":453,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.142","events":445,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.221","events":438,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.139","events":399,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.197","events":241,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.239","events":227,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.149","events":221,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"45.142.193.200","events":209,"country_code":"RO","country":"Romania","org":"Skynet Network Ltd","rdns":"","scanner_tag":null},{"ip":"178.16.53.180","events":108,"country_code":"NL","country":"Netherlands","org":"Omegatech LTD","rdns":"","scanner_tag":null},{"ip":"88.214.25.134","events":64,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.130","events":60,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.137","events":59,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.131","events":58,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.138","events":54,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.135","events":49,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.136","events":46,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"88.214.25.132","events":44,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"37.77.150.10","events":44,"country_code":"RU","country":"Russia","org":"Proton66 OOO","rdns":"","scanner_tag":null},{"ip":"88.214.25.133","events":42,"country_code":"DE","country":"Germany","org":"Layer7 Networks GmbH","rdns":"","scanner_tag":null},{"ip":"91.92.242.15","events":32,"country_code":"NL","country":"Netherlands","org":"Omegatech LTD","rdns":"","scanner_tag":null},{"ip":"193.24.123.55","events":26,"country_code":"RU","country":"Russia","org":"Prospero Ooo","rdns":"","scanner_tag":null},{"ip":"91.202.233.46","events":24,"country_code":"TM","country":"Turkmenistan","org":"Prospero Ooo","rdns":"","scanner_tag":null},{"ip":"176.120.22.74","events":22,"country_code":"RU","country":"Russia","org":"Proton66 OOO","rdns":"","scanner_tag":null},{"ip":"91.92.43.130","events":19,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"91.92.33.66","events":18,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"91.92.33.114","events":18,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"93.152.224.157","events":16,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"91.92.43.129","events":15,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"93.152.224.173","events":14,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"91.92.33.65","events":14,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"91.92.33.34","events":13,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"94.26.90.114","events":13,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"45.74.59.2","events":12,"country_code":"US","country":"United States","org":"Net Gate Telecom S.R.L.","rdns":"","scanner_tag":null},{"ip":"37.77.150.72","events":11,"country_code":"RU","country":"Russia","org":"Proton66 OOO","rdns":"","scanner_tag":null},{"ip":"93.152.224.155","events":11,"country_code":"DE","country":"Germany","org":"Dedik Services Limited","rdns":"","scanner_tag":null},{"ip":"82.24.200.58","events":11,"country_code":"US","country":"United States","org":"Tier.Net Technologies LLC","rdns":"fmQB7ho0.strike.bz","scanner_tag":null},{"ip":"199.47.242.83","events":10,"country_code":"NL","country":"Netherlands","org":"LeaseWeb Netherlands B.V.","rdns":"","scanner_tag":null},{"ip":"79.124.49.102","events":9,"country_code":"BG","country":"Bulgaria","org":"Tamatiya EOOD","rdns":"ip-49-102.4vendeta.com","scanner_tag":null},{"ip":"194.165.16.11","events":9,"country_code":"MC","country":"Monaco","org":"Flyservers S.A.","rdns":"ptr.flow-metric.com","scanner_tag":null},{"ip":"199.47.242.80","events":8,"country_code":"NL","country":"Netherlands","org":"LeaseWeb Netherlands B.V.","rdns":"","scanner_tag":null},{"ip":"184.107.106.72","events":5,"country_code":"CA","country":"Canada","org":"Leaseweb Canada Inc.","rdns":"72.106.107.184.hosted.by.hostdzire.com","scanner_tag":null},{"ip":"80.87.206.20","events":5,"country_code":"RU","country":"Russia","org":"OVH SAS","rdns":"","scanner_tag":null},{"ip":"213.209.159.74","events":4,"country_code":"TW","country":"Taiwan","org":"Feo Prest SRL","rdns":"","scanner_tag":null},{"ip":"138.226.239.5","events":4,"country_code":"GB","country":"United Kingdom","org":"HomeLine Broadband LLC","rdns":"","scanner_tag":null}],"top_asns":[{"asn":50360,"org":"Tamatiya EOOD","events":49701,"ips":3},{"asn":213790,"org":"Limited Network LTD","events":11459,"ips":1},{"asn":214295,"org":"Skynet Network Ltd","events":2983,"ips":10},{"asn":208137,"org":"Feo Prest SRL","events":2701,"ips":3},{"asn":213388,"org":"Iic Rail Limited","events":695,"ips":7},{"asn":35042,"org":"Layer7 Networks GmbH","events":479,"ips":10},{"asn":207043,"org":"Dedik Services Limited","events":151,"ips":10},{"asn":202412,"org":"Omegatech LTD","events":140,"ips":2},{"asn":198953,"org":"Proton66 OOO","events":78,"ips":4},{"asn":200593,"org":"Prospero Ooo","events":51,"ips":3}],"fingerprints":{"ja4h":["po11nn19en_317963a85131","ge11nn0400_11975a10f91b","ge11nn0300_dedeb29cc523","ge11nn07en_c3e833da1ad8","po11nn0600_da06d4cb66f4","ge11nn0400_ef4d07580f66"],"ja4":["t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i3112h1_e8f1e7e78f70_d339722ba4af","t13i181100_e8a523a41297_02c8e53ee398","t13i180900_e8a523a41297_78e6aca7449b","t13i131000_f57a46bbacb6_ab7e3b40a677"]},"sample_paths":["/global-protect/login.esp","/tcp/global-protect/login.esp","//global-protect/login.esp"],"timeline":[{"day":"2026-05-02","events":10,"ips":1},{"day":"2026-05-03","events":5,"ips":1},{"day":"2026-05-06","events":20,"ips":1},{"day":"2026-05-07","events":9,"ips":1},{"day":"2026-05-09","events":93,"ips":3},{"day":"2026-05-15","events":12,"ips":1},{"day":"2026-05-21","events":3,"ips":1},{"day":"2026-05-25","events":21,"ips":2},{"day":"2026-05-26","events":31,"ips":3},{"day":"2026-05-27","events":52,"ips":2},{"day":"2026-05-28","events":6,"ips":1},{"day":"2026-05-29","events":10,"ips":4},{"day":"2026-05-30","events":1,"ips":1},{"day":"2026-05-31","events":1,"ips":1},{"day":"2026-06-01","events":101,"ips":7},{"day":"2026-06-02","events":61,"ips":10},{"day":"2026-06-03","events":98,"ips":9},{"day":"2026-06-04","events":330,"ips":24},{"day":"2026-06-05","events":367,"ips":4},{"day":"2026-06-06","events":68,"ips":11},{"day":"2026-06-07","events":112,"ips":11},{"day":"2026-06-08","events":195,"ips":11},{"day":"2026-06-09","events":298,"ips":12},{"day":"2026-06-10","events":153,"ips":11},{"day":"2026-06-11","events":265,"ips":11},{"day":"2026-06-12","events":95,"ips":11},{"day":"2026-06-13","events":240,"ips":11},{"day":"2026-06-14","events":23,"ips":6},{"day":"2026-06-15","events":179,"ips":11},{"day":"2026-06-16","events":349,"ips":11},{"day":"2026-06-17","events":496,"ips":13},{"day":"2026-06-18","events":1462,"ips":3},{"day":"2026-06-19","events":338,"ips":1},{"day":"2026-06-20","events":1719,"ips":4},{"day":"2026-06-21","events":2196,"ips":4},{"day":"2026-06-22","events":2467,"ips":5},{"day":"2026-06-23","events":2255,"ips":4},{"day":"2026-06-24","events":2267,"ips":1},{"day":"2026-06-25","events":2029,"ips":2},{"day":"2026-06-26","events":2092,"ips":3},{"day":"2026-06-27","events":1827,"ips":1},{"day":"2026-06-28","events":1824,"ips":1},{"day":"2026-06-29","events":1858,"ips":1},{"day":"2026-06-30","events":1927,"ips":1},{"day":"2026-07-01","events":1815,"ips":1},{"day":"2026-07-02","events":1830,"ips":3},{"day":"2026-07-03","events":1852,"ips":10},{"day":"2026-07-04","events":1815,"ips":11},{"day":"2026-07-05","events":1526,"ips":13},{"day":"2026-07-06","events":2006,"ips":119},{"day":"2026-07-07","events":1918,"ips":23},{"day":"2026-07-08","events":2077,"ips":88},{"day":"2026-07-09","events":1901,"ips":75},{"day":"2026-07-10","events":1828,"ips":12},{"day":"2026-07-11","events":1834,"ips":12},{"day":"2026-07-12","events":1778,"ips":12},{"day":"2026-07-13","events":1915,"ips":18},{"day":"2026-07-14","events":1609,"ips":13},{"day":"2026-07-15","events":1503,"ips":7},{"day":"2026-07-16","events":1477,"ips":10},{"day":"2026-07-17","events":1542,"ips":14},{"day":"2026-07-18","events":1807,"ips":12},{"day":"2026-07-19","events":1883,"ips":17},{"day":"2026-07-20","events":1861,"ips":4},{"day":"2026-07-21","events":1860,"ips":12},{"day":"2026-07-22","events":1892,"ips":8},{"day":"2026-07-23","events":1163,"ips":8},{"day":"2026-07-24","events":43,"ips":11},{"day":"2026-07-25","events":41,"ips":14},{"day":"2026-07-26","events":30,"ips":6},{"day":"2026-07-27","events":35,"ips":15},{"day":"2026-07-28","events":5,"ips":3}],"window_hours":2160}