CVE-2018-0010

A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1...

CVE-2018-0008

The CVE-2018-0008 entry describes an authentication bypass in Junos OS where an unauthenticated root login can occur after a reboot when a commit script is used. During normal commit, certain scripts may trigger a mode change on reboot that leaves the system in a safe-mode authentication state, a...

CVE-2018-0001

CVE-2018-0001 affects Junos OS via the J-Web interface: a use-after-free defect in older PHP handling could allow an unauthenticated remote code execution by crafting data sent to specific PHP URLs. Affected Junos releases include 12.1X46 (before 12.1X46-D67), 12.3 (before 12.3R12-S5), 12.3X48 (b...

CVE-2018-0006 Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects

A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon bbe-smgd, and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number o...

CVE-2018-0011 Junos Space: Reflected XSS vulnerability in Junos Space management interface

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

CVE-2018-0010

CVE-2018-0010 affects Junos Space Security Director. The vulnerability allows a user without SSH access to a device to reuse a URL created for another user to gain SSH access. Affected releases are all versions prior to 17.2R1. The provided documents do not detail the underlying root cause beyond...

CVE-2018-0004

CVE-2018-0004 affects Junos OS kernel: Kernel Denial of Service in the register/schedule interrupt handler triggered by a sustained sequence of normal transit traffic. Affects Junos OS releases listed in the entry (e.g., 12.1X46 prior to -D50; 12.3X48 prior to -D30; 12.3R before -R12-S7; 14.1 bef...

CVE-2018-0009 SRX Series: Firewall bypass vulnerability when UUID with leading zeros is configured.

On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...

CVE-2018-0005

CVE-2018-0005 affects Juniper Networks Junos OS on QFX and EX Series switches. When MAC move limit is exceeded, the device forwards instead of dropping, enabling a denial-of-service/unstable behavior. Affected releases: Junos OS 14.1X53 before 14.1X53-D40; 15.1X53 before 15.1X53-D55; 15.1 before ...

CVE-2018-0004 Junos OS: Kernel Denial of Service Vulnerability

A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and...

CVE-2018-0005 Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic.

QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D40;...

CVE-2018-0008 Junos OS: commit script may allow unauthenticated root login upon reboot

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

CVE-2018-0007

CVE-2018-0007 describes a memory corruption vulnerability in Junos OS triggered by unauthenticated LLDP packets on local segments, potentially leading to denial of service and, if authenticated on the device, arbitrary code execution with privilege escalation. The issue affects Junos OS releases ...

CVE-2018-0012

CVE-2018-0012 affects Junos Space and describes a privilege-escalation vulnerability that could allow a local authenticated attacker to obtain root privileges. The connected documents confirm Junos Space as the affected product and identify the impact (local escalation to root) and the attack con...

CVE-2018-0009

CVE-2018-0009 affects Juniper SRX devices running Junos OS where firewall rules matching custom application UUIDs that begin with zeros can match all TCP traffic, enabling a firewall bypass. Affected releases include Junos OS: 12.1X46 before D71, 12.3X48 before D55, and 15.1X49 before D100 on SRX...

CVE-2018-0006

The CVE-2018-0006 vulnerability affects Junos OS on devices configured for DHCPv4/v6 over AE auto-sensed VLANs in Broadband Edge deployments. The issue is a Denial of Service caused by a high rate of VLAN authentication requests triggering unbounded memory allocations in the bbe-smgd (BBE subscri...

CVE-2018-0013 Junos Space: Local File Inclusion Vulnerability

A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system...

CVE-2018-0011

CVE-2018-0011 is a reflected XSS vulnerability in Junos Space management interface. The issue allows a remote authenticated user to inject web script or HTML, potentially steal session data/credentials and perform administrative actions on the Junos Space device. Connected sources (e.g., NVD entr...

CVE-2018-0001 Junos: Unauthenticated Remote Code Execution through J-Web interface

A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions...

CVE-2018-0013

CVE-2018-0013 affects Juniper Networks Junos Space Network Management Platform. The vulnerability is a local file inclusion that may allow an authenticated user to retrieve files from the system. Public data lists CVSS v3.0 base score 6.5 (MEDIUM) with network attack vector, low complexity, and p...