CVE-2019-0024: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0026: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

CVE-2019-0003: Reachable Assertion

When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon rpd process to crash with a core file being generated. Affected...

CVE-2019-0029: Insertion of Sensitive Information into Log File

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

PT-2019-1369

Name of the Vulnerable Software and Affected Versions Juniper ATP versions prior to 5.0.3 Description A persistent cross-site scripting XSS issue in the Snort Rules configuration may allow an authenticated user to inject arbitrary script, potentially stealing sensitive data and credentials from a...

CVE-2019-0027: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting XSS vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Juniper SRX Series Junos OS Denial of Service Vulnerability

Juniper SRX Series is an SRX Series firewall appliance from Juniper Networks, Inc. Junos OS is the operating system that runs on it. A security vulnerability exists in Junos OS versions 12.1X46, 12.3X48, and 15.1X49 on the Juniper SRX Series. An attacker could exploit this vulnerability with...

Juniper Junos vMX Predictable IP ID Sequence Numbers (JSA10903)

According to its self-reported version number, the remote Junos device uses a predictable IP ID sequence number. It is, therefore, vulnerable to a family of attacks that rely on this property, including a susceptibility to being used as a 'zombie' host in an 'idle scan' blind port scan of another...

Junos OS: FPC process crashes after J-Flow processes a malformed packet (JSA10914)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service DoS. This issue affects both IPv4 a...

Junos OS: pd crash on VPLS PE upon receipt of specific BGP message (JSA10912)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability which allows an attacker to craft a specific BGP message to cause the routing protocol daemon rpd process to crash and restart. While rpd restarts after a crash, repeate...

Junos OS: Multiple vulnerabilities in libxml2 (JSA10916)

According to its self-reported version number, the remote Juniper Junos device is affected by a Multiple vulnerabilities in libxml2: - Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.CVE-2016-4448 - Th...

Juniper Junos Packet Forwarding Engine Potential RCE (JSA10906)

According to its self-reported version number, the remote Junos device is affected by a potential remote code execution vulnerability due to how the Packet Forwarding Engine manager FXPC handles HTTP packets. An attacker could potentially crash the fxpc daemon or execute code. C Tenable Network...

Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)

According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : - An integer overflow issue exists in procps-ng. This is related to CVE-2018-1124. CVE-2018-1126 - A directory traversal issue exits in...

Juniper Networks Releases Multiple Security Updates

Juniper Networks has released multiple security updates to address vulnerabilities in various Juniper products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The National Cybersecurity and Communications Integration Center NCCIC, part of the...

PT-2019-1173

Name of the Vulnerable Software and Affected Versions Juniper Advanced Threat Prevention versions prior to 5.0.4 Description The issue is related to the storage of a secret passphrase in clear text in the /var/log/syslog file. This could allow an authenticated local user to view sensitive...

PT-2019-1175

Name of the Vulnerable Software and Affected Versions Juniper Advanced Threat Prevention versions prior to 5.0.3 Description The issue is related to the use of the DES algorithm and a hardcoded salt for password hashing in Juniper Advanced Threat Prevention. This allows for trivial de-hashing of...

PT-2019-1142

Name of the Vulnerable Software and Affected Versions: Juniper ATP versions prior to 5.0.3 Description: The issue is related to the logging of sensitive keys in a file that can be read by authenticated local users. These keys are used for critical operations on the WebUI interface. The problem is...

PT-2019-1180

Name of the Vulnerable Software and Affected Versions Juniper Networks Juniper ATP versions prior to 5.0.3 Description The issue is related to hard-coded credentials in the Cyphort Core instance of Juniper ATP, allowing an attacker to gain full control of the software. It is also described as a...

PT-2019-1179

Name of the Vulnerable Software and Affected Versions Juniper Networks Juniper ATP version 5.0 prior to 5.0.3 Description The issue is related to hard-coded credentials in the Web Collector instance of Juniper ATP, allowing an attacker to gain full control of the software. The vulnerability can b...

PT-2019-1181

Name of the Vulnerable Software and Affected Versions Juniper ATP Series versions prior to 5.0.3 Description The issue is related to the storage of credentials in a file that can be accessed by authenticated local users, potentially allowing an attacker to access the Splunk server. This could...