CVE-2018-0009

CVE-2018-0009 affects Juniper SRX devices running Junos OS where firewall rules matching custom application UUIDs that begin with zeros can match all TCP traffic, enabling a firewall bypass. Affected releases include Junos OS: 12.1X46 before D71, 12.3X48 before D55, and 15.1X49 before D100 on SRX...

CVE-2018-0011 Junos Space: Reflected XSS vulnerability in Junos Space management interface

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

PT-2018-8558

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 14.1X53-D40 Junos OS versions prior to 15.1X53-D55 Junos OS versions prior to 15.1R7 Description: A issue in QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded can cause the...

CVE-2018-0007: Improper Neutralization of Special Elements used in a Command

An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able to cause a Junos device to enter an improper boundary check condition allowing a memory corruption to occur, leading to a denial of service...

CVE-2018-0005: Improper Check for Unusual or Exceptional Conditions

QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D40;...

CVE-2018-0013: Exposure of Sensitive Information to an Unauthorized Actor

A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system...

CVE-2018-0012: Undefined Security Weakness

Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges...

CVE-2018-0002: Improper Restriction of Operations within the Bounds of a Memory Buffer

On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in...

PT-2018-8557

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 12.1X46-D71 Junos OS versions prior to 12.3R12-S7 Junos OS versions prior to 12.3X48-D55 Junos OS versions prior to 14.1R8-S5 Junos OS versions prior to 14.1R9 Junos OS versions prior to 14.1X53-D45 Junos OS version...

CVE-2018-0001: Use After Free

A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions...

CVE-2018-0004: Uncontrolled Resource Consumption

A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and schedule software interrupt handler subsystem when a specific command is issued to the device. This affects one or more threads and...

CVE-2018-0011: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting XSS vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session, and to perform administrative actions on the Junos Space network management device...

CVE-2018-0006: Allocation of Resources Without Limits or Throttling

A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon bbe-smgd, and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number o...

CVE-2018-0010: Improper Privilege Management

A vulnerability in the Juniper Networks Junos Space Security Director allows a user who does not have SSH access to a device to reuse the URL that was created for another user to perform SSH access. Affected releases are all versions of Junos Space Security Director prior to 17.2R1...

CVE-2018-0009: Undefined Security Weakness

On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass...

CVE-2018-0008: Improper Authentication

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the system scripts commit stanza. Certain commit scripts that work without a problem during norm...

PT-2018-1041

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 12.1X46-D71 Juniper Networks Junos OS versions prior to 12.3R12-S7 Juniper Networks Junos OS versions prior to 12.3X48-D55 Juniper Networks Junos OS versions prior to 14.1R8-S5 Juniper Networks Junos...

PT-2018-8564

Name of the Vulnerable Software and Affected Versions: Junos Space Network Management Platform affected versions not specified Description: A local file inclusion issue may allow an authenticated user to retrieve files from the system. Recommendations: At the moment, there is no information about...

PT-2018-8559

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 15.1R6-S2, 15.1R7 Junos OS versions prior to 16.1R5-S1, 16.1R6 Junos OS versions prior to 16.2R2-S2, 16.2R3 Junos OS versions prior to 17.1R2-S5, 17.1R3 Junos OS versions prior to 17.2R2 Description: A high rate of...

PT-2018-8561

Name of the Vulnerable Software and Affected Versions: Junos Space Security Director versions prior to 17.2R1 Description: A vulnerability in the Juniper Networks Junos Space Security Director allows unauthorized SSH access to a device by reusing a URL created for another user. Recommendations: F...