CVE-2019-0004 Juniper ATP: API and device keys are logged in a world-readable permissions file

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0030 Juniper ATP: Password hashing uses DES and a hardcoded salt

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0012 Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message

A Denial of Service DoS vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon rpd process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended...

CVE-2019-0018 Juniper ATP: Persistent Cross-Site Scripting (XSS) vulnerability in file upload menu

A persistent cross-site scripting XSS vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0012

CVE-2019-0012 describes a DoS in Juniper Junos OS for VPLS PE: processing a crafted BGP message crashes the rpd daemon, potentially causing extended DoS due to repeated restarts. Affected are PE routers with BGP Auto discovery for LDP VPLS. Vulnerable releases include multiple Junos OS versions l...

CVE-2019-0018

The CVE-2019-0018 entry documents a persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP, affecting Juniper ATP 5.0 versions prior to 5.0.3. The issue allows an authenticated attacker to inject arbitrary scripts and potentially steal sensitive data or credent...

PT-2019-1367

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description The issue is related to insufficient input validation in the Zone configuration component of Juniper ATP, which may allow a remote attacker to inject arbitrary JavaScript code into a loaded page...

PT-2019-1364

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the file upload menu may allow an authenticated user to inject arbitrary scripts, potentially stealing sensitive data and credentials from a web...

PT-2019-1365

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the Golden VM menu of Juniper ATP may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials fr...

CVE-2019-0027: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

PT-2019-1366

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the RADIUS configuration menu may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials from a...

PT-2019-1368

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the Email Collectors menu of Juniper ATP may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and...

CVE-2019-0021: Insertion of Sensitive Information into Log File

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4...

CVE-2019-0022: Use of Hard-coded Credentials

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0025: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0014: Undefined Security Weakness

On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC Flexible PIC Concentrator process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Servi...

CVE-2019-0030: Use of a Broken or Risky Cryptographic Algorithm

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0004: Insertion of Sensitive Information into Log File

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

CVE-2019-0020: Use of Hard-coded Credentials

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3...

CVE-2019-0023: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative...