CVE-2019-0020 Juniper ATP: Hard coded credentials used in Web Collector

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0029

Juniper ATP Series has a vulnerability where Splunk credentials are logged in a file readable by authenticated local users, enabling access to the Splunk server. Affected product: Juniper Advanced Threat Prevention (ATP) 5.0 versions prior to 5.0.3. Root cause: credentials stored in clear text in...

CVE-2019-0014

CVE-2019-0014 affects Juniper Networks Junos OS on QFX and PTX Series. A malformed packet used by J-Flow sampling can crash the FPC (Flexible PIC Concentrator) process, causing a Denial of Service across all interfaces. The issue impacts both IPv4 and IPv6 packet processing. Affected releases inc...

CVE-2019-0029 Juniper ATP: Splunk credentials are in logged in clear text

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0005

CVE-2019-0005 affects Juniper Junos OS on EX and QFX series (EX2300/3400/4600; QFX3K/5K). The vulnerability is that firewall filter configuration cannot match IPv6 extension headers, potentially allowing IPv6 packets that should be blocked to be forwarded; IPv4 filtering is unaffected. Affected r...

CVE-2019-0026

CVE-2019-0026 recap (NormaL details): Juniper ATP’s Zone configuration contains a persistent XSS vulnerability. Affected product/version: Juniper ATP 5.0.x prior to 5.0.3. Exploitation requires an authenticated user who can inject arbitrary scripts, potentially stealing data and credentials from ...

CVE-2019-0030

Juniper Advanced Threat Prevention (ATP) variant 5.0 before 5.0.3 uses DES with a hardcoded salt for password hashing, enabling trivial recovery of hashed password contents. Affects Juniper ATP 5.0.x releases prior to 5.0.3. The CVE entry is corroborated by multiple sources (NVD/CNVD/CVELIST). Re...

CVE-2019-0025

CVE-2019-0025 : Juniper ATP contains a persistent XSS in the RADIUS configuration menu. AFFECTED: Juniper ATP 5.0 versions prior to 5.0.3. ROOT CAUSE: stored/reflective cross-site scripting in the web admin interface. IMPACT: authenticated users can inject script to steal data/credentials from a ...

CVE-2019-0022

CVE-2019-0022 describes a vulnerability in Juniper ATP where the Cyphort Core instance ships with hard-coded credentials , enabling an attacker to gain full control of an affected installation. The impact affects Juniper ATP 5.0 releases prior to 5.0.3, with a network-accessible vector and high s...

CVE-2019-0017 Junos Space: Unrestricted file upload vulnerability

The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1...

CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...

CVE-2019-0005

On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected...

CVE-2019-0006

Summary of CVE-2019-0006 (Juniper Junos FXPC): A crafted HTTP packet can trigger an uninitialized function pointer dereference in the Packet Forwarding Engine manager (FXPC) on EX, QFX and MX Series devices in a Virtual Chassis. This can crash the fxpc daemon or potentially allow remote code exec...

CVE-2019-0023 Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu

A persistent cross-site scripting XSS vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative...

CVE-2019-0023

The CVE concerns a persistent Cross-Site Scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP. Affected product: Juniper ATP 5.0 series prior to 5.0.3. Root cause: XSS in the Golden VM menu that could allow an authenticated user to inject arbitrary scripts and potentially steal data...

CVE-2019-0013 Junos OS: RPD crash upon receipt of malformed PIM packet

The routing protocol daemon RPD process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service DoS condition. This issue only affects IPv4 PIM. IPv6 PIM is unaffected by this...

CVE-2019-0013

The CVE-2019-0013 issue affects Junos OS RPD when handling malformed IPv4 PIM Join packets. Affected Junos releases include 12.1X46 (prior to -D77), 12.3X48 (prior to -D77), 15.1 line (prior to 15.1F6-S10, 15.1R6-S6, 15.1R7), 15.1X49 (prior to -D150), 15.1X53 (prior to -D233, -D59), 16.1 (prior t...

CVE-2019-0024

Summary: CVE-2019-0024 is a persistent XSS vulnerability in Juniper ATP, specifically in the Email Collectors menu. Multiple sources confirm that authenticated users can inject arbitrary scripts, potentially exfiltrating data and credentials from a web administration session and possibly tricking...

CVE-2019-0011

Junos OS kernel crash vulnerability CVE-2019-0011 affects the Junos OS kernel when processing a crafted packet to an out-of-band management interface (fxp0, me0, em0, vme0) destined for another address, enabling an attacker on the adjacent network to trigger repeated kernel crashes and a sustaine...

CVE-2019-0004

CVE-2019-0004 affects Juniper ATP 5.0 prior to 5.0.3. The issue is that API keys and device keys are logged to a file readable by local authenticated users, enabling potential abuse of WebUI operations. Affected component: Juniper ATP 5.0.x; root cause: keys logged to a world-readable/local file....