7168 matches found
Authentication flaw
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...
Default configuration
If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password...
Stack overflow
A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager FXPC process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code...
CVE-2019-0041
On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface lo0. The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This...
CVE-2019-0032
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...
CVE-2019-0042
Juniper Identity Management Service JIMS for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of...
Input validation
Juniper Identity Management Service JIMS for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of...
Design/Logic Flaw
A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service DoS. This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D2...
CVE-2019-0033
A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service DoS. This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D2...
Design/Logic Flaw
When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon rpd process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to...
Design/Logic Flaw
On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface lo0. The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This...
Design/Logic Flaw
When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM Operations, Administration, and Maintenance volume, leading to...
Design/Logic Flaw
Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart vmcore. By continuously sending a specially crafted packet to the fxp0 interface, an attacker can repetitively crash the rpd process causing prolonged Denial of Service DoS. Affecte...
CVE-2019-0008
A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager FXPC process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code...
CVE-2019-0032
A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...
CVE-2019-0036
When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" e.g. "internal-1", "internal-2", etc. are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets...
CVE-2019-0037
In a Dynamic Host Configuration Protocol version 6 DHCPv6 environment, the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client. By continuously sending the same crafted packet, an attacker can repeatedly crash the jdhcpd process causin...
CVE-2019-0042
Juniper Identity Management Service JIMS for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of...
CVE-2019-0033
A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service DoS. This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D2...
CVE-2019-0032
The CVE describes an authentication credential leakage issue where Organisation login usernames and passwords are stored in plaintext in log files. A locally authenticated attacker who can access these logs could use the plaintext credentials to login. Affected products are Juniper Networks Servi...