PT-2014-5530

Name of the Vulnerable Software and Affected Versions Juniper SRX Series devices with Junos versions prior to 11.4R12-S4 Juniper SRX Series devices with Junos versions 12.1X44 before 12.1X44-D40 Juniper SRX Series devices with Junos versions 12.1X45 before 12.1X45-D30 Juniper SRX Series devices...

PT-2014-5525

Name of the Vulnerable Software and Affected Versions Juniper Junos OS versions 9.1 through 11.4 before 11.4R11 Juniper Junos OS versions 12.1 before R10 Juniper Junos OS versions 12.1X44 before D40 Juniper Junos OS versions 12.1X46 before D30 Juniper Junos OS versions 12.1X47 before D11 and...

Juniper Junos RADIUS Security Bypass (JSA10654)

According to its self-reported version number, the remote Juniper Junos device is affected by a security bypass vulnerability. This issue is caused by RADIUS accounting servers being used for authentication requests. An authenticated attacker can exploit this to bypass authentication. TRUSTED...

CVE-2014-6378: Undefined Security Weakness

Juniper Junos 11.4 before R12-S4, 12.1X44 before D35, 12.1X45 before D30, 12.1X46 before D25, 12.1X47 before D10, 12.2 before R9, 12.2X50 before D70, 12.3 before R7, 13.1 before R4 before S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R5, 13.2X50 before D20, 13.2X51 before D26 and D30,...

Juniper Junos 'em' Interface Fragmentation Remote DoS (JSA10655)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. A remote attacker can exploit this issue by sending a set of specially crafted fragmented packets to cause the 'em' driver to become permanently blocked when trying to...

Juniper Junos RSVP 'rpd' Remote DoS (JSA10652)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to improper handling of RSVP PATH messages. A remote attacker can exploit this issue, by sending a specially crafted RSVP packet, to crash the 'rpd' process. Note th...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10649)

According to its self-reported version number, the remote Junos device is affected by multiple vulnerabilities in the implementation of OpenSSL : - An error exists related to 'ec point format extension' handling and multithreaded clients that allows freed memory to be overwritten during a resumed...

CVE-2014-3818: Improper Restriction of Operations within the Bounds of a Memory Buffer

Juniper Junos OS 9.1 through 11.4 before 11.4R11, 12.1 before R10, 12.1X44 before D40, 12.1X46 before D30, 12.1X47 before D11 and 12.147-D15, 12.1X48 before D41 and D62, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S2, 13.1X49 before D49, 13.1X50 before 30, 13.2 before R4,...

CVE-2014-3811

Juniper Installer Service JIS Client 7.x before 7.4R6 for Windows and Junos Pulse Client before 4.0R6 allows local users to gain privileges via unspecified vectors...

CVE-2014-3820

Cross-site scripting XSS vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4...

CVE-2014-3823

The Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 8.0 before 8.0r1, 7.4 before 7.4r5, and 7.1 before 7.1r18 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2014-3824

Cross-site scripting XSS vulnerability in the web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 8.0 before 8.0r6, 7.4 before 7.4r13, and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4...

Cross site scripting

Cross-site scripting XSS vulnerability in the web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 8.0 before 8.0r6, 7.4 before 7.4r13, and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3811

Juniper Installer Service JIS Client 7.x before 7.4R6 for Windows and Junos Pulse Client before 4.0R6 allows local users to gain privileges via unspecified vectors...

CVE-2014-3820

Cross-site scripting XSS vulnerability in the SSL VPN/UAC web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 7.1 before 7.1r16, 7.4 before 7.4r3, and 8.0 before 8.0r1 and the Juniper Junos Pulse Access Control Service devices with UAC OS 4.1 before 4.1r8, 4.4...

CVE-2014-3824

Cross-site scripting XSS vulnerability in the web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 8.0 before 8.0r6, 7.4 before 7.4r13, and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3811

CVE-2014-3811 affects Juniper Installer Service (JIS) Client on Windows (7.x before 7.4R6) and Junos Pulse Client before 4.0R6, enabling local privilege escalation. Root cause is not detailed in the provided sources. Impact is high (local, full confidentiality/integrity/availability). Remediation...

CVE-2014-3820

The CVE-2014-3820 anomaly is a documented XSS in Juniper Pulse Secure/Policy products. Affected are the SSL VPN/UAC web server on Junos Pulse Access Service (IVE OS: 7.1 before 7.1r16, 7.4 before 7.4r3, 8.0 before 8.0r1) and the Pulse Access Control Service (UAC OS: 4.1 before 4.1r8, 4.4 before 4...

CVE-2014-3824

CVE-2014-3824 describes a cross-site scripting (XSS) vulnerability in the web server of Juniper Junos Pulse Secure Access Service (SSL VPN) devices using IVE OS. The issue stems from incorrect user input validation on the SSL VPN web page, potentially enabling an attacker to inject arbitrary scri...