CVE-2021-31355 Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal

A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...

CVE-2021-31355

CVE-2021-31355 is a stored cross-site scripting (XSS) vulnerability in Juniper Networks Junos OS captive portal UI. A remote authenticated user can inject script/HTML to steal data from web admin sessions and possibly trick other admins into actions. Affected: Junos OS versions across multiple re...

CVE-2021-31354 Junos OS and Junos OS Evolved: A vulnerability in the Juniper Agile License Client may allow an attacker to perform Remote Code Execution (RCE)

An Out Of Bounds OOB access vulnerability in the handling of responses by a Juniper Agile License JAL Client in Juniper Networks Junos OS and Junos OS Evolved, configured in Network Mode to use Juniper Agile License Manager may allow an attacker to cause a partial Denial of Service DoS, or lead t...

CVE-2021-31354

CVE-2021-31354 affects Juniper Networks Junos OS and Junos OS Evolved when configured in Network Mode with the JAL client. It is an Out Of Bounds (OOB) vulnerability in the client’s packet-parsing logic for responses from the server, potentially allowing partial DoS or remote code execution. Expl...

CVE-2021-31353

Summary : CVE-2021-31353 is a vulnerability in Juniper Networks Junos OS and Junos OS Evolved where processing a crafted BGP update can crash the Routing Protocol Daemon (RPD), causing a DoS. The issue is tied to an improper handling of exceptional conditions and affects specific Ju nis OS/Junos ...

CVE-2021-31353 Junos OS and Junos OS Evolved: RPD core upon receipt of specific BGP update

An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP update, causing the routing protocol daemon RPD to crash and restart, leading to a Denial of Service DoS. Continued receipt and processing of...

CVE-2021-31352

The CVE describes an Information Exposure in Juniper Networks SRC Series devices when configured for NETCONF over SSH, caused by negotiation of weak ciphers. The vulnerability could allow a remote attacker with read/write access to network data to display plaintext bits from a ciphertext block an...

CVE-2021-31352 SRC Series: NETCONF over SSH allows negotiation of weak ciphers

An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit thi...

CVE-2021-31351 Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset

An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious attacker to send a specific packet, triggering the MS-MPC/MS-MIC to reset, causing a Denial of Service DoS. Continued receipt and processing o...

CVE-2021-31351

CVE-2021-31351 affects Juniper Networks Junos OS on MX Series where MS-MPC/MS-MIC packet processing can trigger a reset and sustained DoS due to an improper check for unusual or exceptional conditions. The affected versions span numerous releases (e.g., 17.3R3-S11 through 21.1R1) with prior relea...

CVE-2021-31350

CVE-2021-31350 affects Juniper Junos OS and Junos OS Evolved via the Juniper Extension Toolkit (JET) gRPC API. The issue stems from jsd authenticating a user and passing configuration operations to mgd (root-owned), enabling network-based, low-privilege attackers to perform root-level operations....

CVE-2021-31350 Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET)

An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit JET API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the...

CVE-2021-31349

CVE-2021-31349 affects Juniper Networks 128 Technology Session Smart Router. An authentication bypass flaw arises from the use of an internal HTTP header, enabling a remote attacker to bypass authentication and potentially view internal files, change settings, manipulate services, and execute arb...

CVE-2021-31349 Session Smart Router: Authentication Bypass Vulnerability

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...

CVE-2021-0299

This CVE (CVE-2021-0299) affects Juniper Networks Junos OS and is triggered by processing malformed IPv6 packets. A kernel crash occurs, restarting the device and causing a Denial of Service (DoS); sustained DoS can follow with continued malformed packets. Affected are IPv6-enabled devices runnin...

CVE-2021-0298 Junos OS Evolved: PTX10003, PTX10008: picd core while executing the "show chassis pic" command under certain conditions

A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface concentrator daemon picd process on the FPC, if the command is executed coincident with other system events outside the attacker's control, leading to a Denial...

CVE-2021-0298

A race condition in the show chassis pic command can crash the port interface concentrator daemon (picd) on the FPC, causing DoS when the CLI is executed under certain system events. Affected: Juniper Networks Junos OS Evolved prior to 20.1R2-EVO on PTX10003/PTX10008. Junos OS (non-Evolved) is no...

CVE-2021-0297

The CVE-2021-0297 issue affects Juniper Networks Junos OS Evolved: TCP MD5 authentication processing may allow a BGP/LDP session with MD5 enabled to succeed against a peer that is not configured for MD5. Affected are Junos OS Evolved versions prior to 20.3R2-S1-EVO, 20.4 prior to 20.4R2-EVO, and ...

CVE-2021-0297 Junos OS Evolved: BGP and LDP sessions with TCP MD5 authentication established with peers not configured for authentication

A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured with MD5 authentication to succeed, even if the peer does not have TCP MD5 authentication enabled. This could lead to untrusted or unauthorized sessions being...

CVE-2021-0296

The CVE-2021-0296 entry concerns Juniper Networks CTPView server not enforcing HTTP Strict Transport Security (HSTS). Affected versions are Juniper CTPView 7.3 before 7.3R7 and 9.1 before 9.1R3. Root cause: lack of HSTS header enforcement, which can enable downgrade attacks, SSL-stripping MITM, a...