CVE-2013-6015

Juniper Junos before 10.4S14, 11.4 before 11.4R5-S2, 12.1R before 12.1R3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D15 on SRX Series services gateways, when a plugin using TCP proxy is configured, allows remote attackers to cause a denial of service flow daemon crash via an...

CVE-2013-4689

J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery CSRF protection mechanism and hija...

CVE-2013-4689

CVE-2013-4689 affects Juniper Junos J-Web, where CSRF protection can be bypassed to hijack administrator authentication. Affected Junos releases include before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before...

CVE-2013-6013

CVE-2013-6013 affects Juniper Junos flowd on SRX devices, where a buffer overflow in the flow daemon may allow remote code execution via a crafted Telnet message when telnet pass-through authentication is enabled. Affected versions include Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X4...

Juniper Junos GNU libc glob Remote DoS (JSA10598)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to a flaw in the glob implementation in libc. An authenticated, remote attacker can exploit this, via a crafted glob expression that does not match any pathnames, to...

PT-2013-5923

Name of the Vulnerable Software and Affected Versions Juniper Junos versions prior to 10.4S14 Juniper Junos versions prior to 11.4R5-S2 Juniper Junos versions prior to 12.1R3 Juniper Junos versions prior to 12.1X44-D20 Juniper Junos versions prior to 12.1X45-D15 Description The issue allows remot...

PT-2013-5956

Name of the Vulnerable Software and Affected Versions Juniper Junos versions 10.0 before 10.0S28 Juniper Junos versions 10.4 before 10.4R7 Juniper Junos versions 11.1 before 11.1R5 Juniper Junos versions 11.2 before 11.2R2 Juniper Junos versions 11.4 before 11.4R1 Description The issue allows...

CVE-2013-6013: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the flow daemon flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X44 before 12.1X44-D15, 12.1X45 before 12.1X45-D10 on SRX devices, when using telnet pass-through authentication on the firewall, might allow remote attackers to execute arbitrary code via a...

CVE-2013-6015: Improper Input Validation

Juniper Junos before 10.4S14, 11.4 before 11.4R5-S2, 12.1R before 12.1R3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D15 on SRX Series services gateways, when a plugin using TCP proxy is configured, allows remote attackers to cause a denial of service flow daemon crash via an...

CVE-2013-4689: Cross-Site Request Forgery (CSRF)

J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1R before 12.1R6, 12.1X44 before 12.1X44-D15, 12.1x45 before 12.1X45-D10, 12.2 before 12.2R3, 12.3 before 12.3R2, and 13.1 before 13.1R3 allow remote attackers to bypass the cross-site request forgery CSRF protection mechanism and hija...

Juniper Junos SRX Series flowd telnet Messages Remote Code Execution (JSA10594)

According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a remote code execution vulnerability. A remote attacker can send specially crafted Telnet messages to cause a buffer overflow the flow daemon flowd. Note that this issue only affects devices...

Juniper Junos PIM Remote Denial of Service (JSA10548)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability. A flaw in the way in which the Next-Generation Multicast VPN NGEN MVPN environment process large numbers of specifically crafted PIM join messages can cause the RPD routing daemon to cras...

Juniper Junos Unnumbered Interface Cache Poisoning Remote DoS and Information Disclosure (JSA10595)

According to its self-reported version number, the remote Juniper Junos device is affected by denial of service and information disclosure vulnerabilities. An adjacent attacker can poison the ARP cache and create a bogus forwarding table entry for an IP address, effectively creating a denial of...

CVE-2013-6170: Improper Input Validation

Juniper Junos 10.0 before 10.0S28, 10.4 before 10.4R7, 11.1 before 11.1R5, 11.2 before 11.2R2, and 11.4 before 11.4R1, when in a Next-Generation Multicast VPN NGEN MVPN environment, allows remote attackers to cause a denial of service RPD routing daemon crash via a large number of crafted PIM S,G...

CVE-2013-5649

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

CVE-2013-5649

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

CVE-2013-5649: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.1 before 7.1r15, 7.2 before 7.2r11, 7.3 before 7.3r6, and 7.4 before 7.4r3 allow 1 remote attackers to inject arbitrary web script or HTML via vectors involving login pages, an...

PT-2013-5711

Name of the Vulnerable Software and Affected Versions Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS versions 7.1 through 7.1r14 Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS versions 7.2 through 7.2r10 Juniper Junos Pulse Secure Access Service aka SSL VPN...

CVE-2013-5097

Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a dictionary attack, a...